{"id":3079,"date":"2026-01-06T15:01:03","date_gmt":"2026-01-06T15:01:03","guid":{"rendered":"https:\/\/www.ucartz.com\/updates\/plesk-incorrect-access-control-vulnerability-cve-2025-66430-critical-severity\/"},"modified":"2026-01-06T15:01:03","modified_gmt":"2026-01-06T15:01:03","slug":"plesk-incorrect-access-control-vulnerability-cve-2025-66430-critical-severity","status":"publish","type":"post","link":"https:\/\/www.ucartz.com\/updates\/plesk-incorrect-access-control-vulnerability-cve-2025-66430-critical-severity\/","title":{"rendered":"Plesk Incorrect Access Control Vulnerability (CVE-2025-66430) \u2014 Critical Severity"},"content":{"rendered":"<p>A significant security flaw has been discovered in Plesk 18.0, a popular web hosting control panel. This vulnerability, identified as CVE-2025-66430, stems from incorrect access control within the system. The critical issue allows an attacker to exploit Password Protected Directories, leading to unauthorized root-level access on a Plesk server. This means a regular Plesk user could potentially gain complete control over the server, posing a severe risk to data integrity and system security.<\/p>\n<h2>CVE Details<\/h2>\n<p>This vulnerability is officially documented under the following details:<\/p>\n<ul>\n<li><strong>Product:<\/strong> Plesk 18.0<\/li>\n<li><strong>Published:<\/strong> December 12, 2025<\/li>\n<li><strong>Severity:<\/strong> CRITICAL<\/li>\n<li><strong>Status:<\/strong> Analyzed<\/li>\n<\/ul>\n<h2>Affected Products<\/h2>\n<p>The core product affected by this severe access control issue is:<\/p>\n<ul>\n<li>Plesk 18.0<\/li>\n<\/ul>\n<p>Users running Plesk version 18.0 should take immediate action to address this vulnerability.<\/p>\n<h2>Current Status<\/h2>\n<p>The vulnerability status is &#8220;Analyzed,&#8221; indicating that the issue has been thoroughly investigated and confirmed by security researchers and the vendor. This status typically precedes the release of patches or detailed mitigation advice.<\/p>\n<h2>Severity Level<\/h2>\n<p>CVE-2025-66430 has been assigned a <strong>CRITICAL<\/strong> severity level with a CVSS score of 9.1. This high score reflects the serious nature of the vulnerability. A critical rating means that exploiting this flaw can lead to significant impacts, such as full system compromise, data theft, or denial of service, often with minimal effort from an attacker. The ability for a regular user to gain root access is a particularly dangerous outcome, as it bypasses all standard security measures and allows for complete control over the compromised server.<\/p>\n<h2>Possible Solutions<\/h2>\n<p>Given the critical nature of this incorrect access control vulnerability, it is imperative for all Plesk 18.0 users to implement available fixes promptly. The most effective solution will be to apply the official security updates or patches released by Plesk. System administrators and developers should:<\/p>\n<ol>\n<li><strong>Check for Official Patches:<\/strong> Regularly monitor the official Plesk support portal and release notes for security advisories related to CVE-2025-66430.<\/li>\n<li><strong>Apply Updates Immediately:<\/strong> Once a patch or updated version is available, apply it to your Plesk 18.0 installation without delay. Keeping your software up-to-date is the most crucial step in protecting against known vulnerabilities.<\/li>\n<li><strong>Follow Plesk\u2019s Security Recommendations:<\/strong> Adhere to all security best practices outlined by Plesk for server hardening and access management.<\/li>\n<\/ol>\n<p>Always back up your data before performing any system updates or changes to ensure a smooth recovery in case of unexpected issues.<\/p>\n<h2>References<\/h2>\n<p>https:\/\/docs.plesk.com\/release-notes\/obsidian\/whats-new\/<\/p>\n<p>https:\/\/support.plesk.com\/hc\/en-us\/articles\/36261922405015&#8211;CVE-2025-66430-Security-vulnerability-in-Password-Protected-Directories-allows-Plesk-users-to-gain-root-level-access-to-a-Plesk-server<\/p>\n","protected":false},"excerpt":{"rendered":"<p>A significant security flaw has been discovered in Plesk 18.0, a popular web hosting control panel. This vulnerability, identified as CVE-2025-66430, stems from incorrect access control within the system. The critical issue allows an attacker to exploit Password Protected Directories, leading to unauthorized root-level access on a Plesk server. This means a regular Plesk user [&hellip;]<\/p>\n","protected":false},"author":17,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[782,917,744,779,918],"class_list":["post-3079","post","type-post","status-publish","format-standard","hentry","category-security","tag-access-control","tag-plesk","tag-privilege-escalation","tag-server-security","tag-web-hosting"],"blocksy_meta":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.5 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Plesk Incorrect Access Control Vulnerability (CVE-2025-66430) \u2014 Critical Severity - Web Hosting and IT Consultancy Services<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.ucartz.com\/updates\/plesk-incorrect-access-control-vulnerability-cve-2025-66430-critical-severity\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Plesk Incorrect Access Control Vulnerability (CVE-2025-66430) \u2014 Critical Severity - Web Hosting and IT Consultancy Services\" \/>\n<meta property=\"og:description\" content=\"A significant security flaw has been discovered in Plesk 18.0, a popular web hosting control panel. This vulnerability, identified as CVE-2025-66430, stems from incorrect access control within the system. The critical issue allows an attacker to exploit Password Protected Directories, leading to unauthorized root-level access on a Plesk server. This means a regular Plesk user [&hellip;]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.ucartz.com\/updates\/plesk-incorrect-access-control-vulnerability-cve-2025-66430-critical-severity\/\" \/>\n<meta property=\"og:site_name\" content=\"Web Hosting and IT Consultancy Services\" \/>\n<meta property=\"article:published_time\" content=\"2026-01-06T15:01:03+00:00\" \/>\n<meta name=\"author\" content=\"Alex Joseph\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Alex Joseph\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.ucartz.com\\\/updates\\\/plesk-incorrect-access-control-vulnerability-cve-2025-66430-critical-severity\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.ucartz.com\\\/updates\\\/plesk-incorrect-access-control-vulnerability-cve-2025-66430-critical-severity\\\/\"},\"author\":{\"name\":\"Alex Joseph\",\"@id\":\"https:\\\/\\\/www.ucartz.com\\\/updates\\\/#\\\/schema\\\/person\\\/1ba9bfab02a76dee216c9f55bb634e56\"},\"headline\":\"Plesk Incorrect Access Control Vulnerability (CVE-2025-66430) \u2014 Critical Severity\",\"datePublished\":\"2026-01-06T15:01:03+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.ucartz.com\\\/updates\\\/plesk-incorrect-access-control-vulnerability-cve-2025-66430-critical-severity\\\/\"},\"wordCount\":410,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/www.ucartz.com\\\/updates\\\/#organization\"},\"keywords\":[\"Access Control\",\"Plesk\",\"Privilege Escalation\",\"Server Security\",\"Web Hosting\"],\"articleSection\":[\"Security\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/www.ucartz.com\\\/updates\\\/plesk-incorrect-access-control-vulnerability-cve-2025-66430-critical-severity\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.ucartz.com\\\/updates\\\/plesk-incorrect-access-control-vulnerability-cve-2025-66430-critical-severity\\\/\",\"url\":\"https:\\\/\\\/www.ucartz.com\\\/updates\\\/plesk-incorrect-access-control-vulnerability-cve-2025-66430-critical-severity\\\/\",\"name\":\"Plesk Incorrect Access Control Vulnerability (CVE-2025-66430) \u2014 Critical Severity - Web Hosting and IT Consultancy Services\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.ucartz.com\\\/updates\\\/#website\"},\"datePublished\":\"2026-01-06T15:01:03+00:00\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.ucartz.com\\\/updates\\\/plesk-incorrect-access-control-vulnerability-cve-2025-66430-critical-severity\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.ucartz.com\\\/updates\\\/plesk-incorrect-access-control-vulnerability-cve-2025-66430-critical-severity\\\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.ucartz.com\\\/updates\\\/plesk-incorrect-access-control-vulnerability-cve-2025-66430-critical-severity\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.ucartz.com\\\/updates\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Plesk Incorrect Access Control Vulnerability (CVE-2025-66430) \u2014 Critical Severity\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.ucartz.com\\\/updates\\\/#website\",\"url\":\"https:\\\/\\\/www.ucartz.com\\\/updates\\\/\",\"name\":\"Web Hosting and IT Consultancy Services\",\"description\":\"Discover the Potential of Digital Transformation through Effortless Hosting and Professional IT Consulting!\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.ucartz.com\\\/updates\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.ucartz.com\\\/updates\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.ucartz.com\\\/updates\\\/#organization\",\"name\":\"Web Hosting and IT Consultancy Services\",\"url\":\"https:\\\/\\\/www.ucartz.com\\\/updates\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.ucartz.com\\\/updates\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.ucartz.com\\\/updates\\\/wp-content\\\/uploads\\\/2025\\\/12\\\/ucartzLogo-1.png\",\"contentUrl\":\"https:\\\/\\\/www.ucartz.com\\\/updates\\\/wp-content\\\/uploads\\\/2025\\\/12\\\/ucartzLogo-1.png\",\"width\":165,\"height\":50,\"caption\":\"Web Hosting and IT Consultancy Services\"},\"image\":{\"@id\":\"https:\\\/\\\/www.ucartz.com\\\/updates\\\/#\\\/schema\\\/logo\\\/image\\\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.ucartz.com\\\/updates\\\/#\\\/schema\\\/person\\\/1ba9bfab02a76dee216c9f55bb634e56\",\"name\":\"Alex Joseph\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/0969fa5fefa2739cbd6fd5eaf04fed619e19f40d42e4a42650090606944ff747?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/0969fa5fefa2739cbd6fd5eaf04fed619e19f40d42e4a42650090606944ff747?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/0969fa5fefa2739cbd6fd5eaf04fed619e19f40d42e4a42650090606944ff747?s=96&d=mm&r=g\",\"caption\":\"Alex Joseph\"},\"description\":\"Alex Joseph is a Senior Support Staff professional with deep experience in server management, web hosting technologies, and cybersecurity operations. He works daily with Linux servers, cloud platforms, performance tuning, and security hardening, giving him strong real-world technical knowledge. Along with his support role, he write about security best practices, hosting infrastructure, and software management.\",\"url\":\"https:\\\/\\\/www.ucartz.com\\\/updates\\\/author\\\/alexjoseph\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Plesk Incorrect Access Control Vulnerability (CVE-2025-66430) \u2014 Critical Severity - Web Hosting and IT Consultancy Services","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.ucartz.com\/updates\/plesk-incorrect-access-control-vulnerability-cve-2025-66430-critical-severity\/","og_locale":"en_US","og_type":"article","og_title":"Plesk Incorrect Access Control Vulnerability (CVE-2025-66430) \u2014 Critical Severity - Web Hosting and IT Consultancy Services","og_description":"A significant security flaw has been discovered in Plesk 18.0, a popular web hosting control panel. This vulnerability, identified as CVE-2025-66430, stems from incorrect access control within the system. The critical issue allows an attacker to exploit Password Protected Directories, leading to unauthorized root-level access on a Plesk server. This means a regular Plesk user [&hellip;]","og_url":"https:\/\/www.ucartz.com\/updates\/plesk-incorrect-access-control-vulnerability-cve-2025-66430-critical-severity\/","og_site_name":"Web Hosting and IT Consultancy Services","article_published_time":"2026-01-06T15:01:03+00:00","author":"Alex Joseph","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Alex Joseph","Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.ucartz.com\/updates\/plesk-incorrect-access-control-vulnerability-cve-2025-66430-critical-severity\/#article","isPartOf":{"@id":"https:\/\/www.ucartz.com\/updates\/plesk-incorrect-access-control-vulnerability-cve-2025-66430-critical-severity\/"},"author":{"name":"Alex Joseph","@id":"https:\/\/www.ucartz.com\/updates\/#\/schema\/person\/1ba9bfab02a76dee216c9f55bb634e56"},"headline":"Plesk Incorrect Access Control Vulnerability (CVE-2025-66430) \u2014 Critical Severity","datePublished":"2026-01-06T15:01:03+00:00","mainEntityOfPage":{"@id":"https:\/\/www.ucartz.com\/updates\/plesk-incorrect-access-control-vulnerability-cve-2025-66430-critical-severity\/"},"wordCount":410,"commentCount":0,"publisher":{"@id":"https:\/\/www.ucartz.com\/updates\/#organization"},"keywords":["Access Control","Plesk","Privilege Escalation","Server Security","Web Hosting"],"articleSection":["Security"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.ucartz.com\/updates\/plesk-incorrect-access-control-vulnerability-cve-2025-66430-critical-severity\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.ucartz.com\/updates\/plesk-incorrect-access-control-vulnerability-cve-2025-66430-critical-severity\/","url":"https:\/\/www.ucartz.com\/updates\/plesk-incorrect-access-control-vulnerability-cve-2025-66430-critical-severity\/","name":"Plesk Incorrect Access Control Vulnerability (CVE-2025-66430) \u2014 Critical Severity - Web Hosting and IT Consultancy Services","isPartOf":{"@id":"https:\/\/www.ucartz.com\/updates\/#website"},"datePublished":"2026-01-06T15:01:03+00:00","breadcrumb":{"@id":"https:\/\/www.ucartz.com\/updates\/plesk-incorrect-access-control-vulnerability-cve-2025-66430-critical-severity\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.ucartz.com\/updates\/plesk-incorrect-access-control-vulnerability-cve-2025-66430-critical-severity\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.ucartz.com\/updates\/plesk-incorrect-access-control-vulnerability-cve-2025-66430-critical-severity\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.ucartz.com\/updates\/"},{"@type":"ListItem","position":2,"name":"Plesk Incorrect Access Control Vulnerability (CVE-2025-66430) \u2014 Critical Severity"}]},{"@type":"WebSite","@id":"https:\/\/www.ucartz.com\/updates\/#website","url":"https:\/\/www.ucartz.com\/updates\/","name":"Web Hosting and IT Consultancy Services","description":"Discover the Potential of Digital Transformation through Effortless Hosting and Professional IT Consulting!","publisher":{"@id":"https:\/\/www.ucartz.com\/updates\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.ucartz.com\/updates\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.ucartz.com\/updates\/#organization","name":"Web Hosting and IT Consultancy Services","url":"https:\/\/www.ucartz.com\/updates\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.ucartz.com\/updates\/#\/schema\/logo\/image\/","url":"https:\/\/www.ucartz.com\/updates\/wp-content\/uploads\/2025\/12\/ucartzLogo-1.png","contentUrl":"https:\/\/www.ucartz.com\/updates\/wp-content\/uploads\/2025\/12\/ucartzLogo-1.png","width":165,"height":50,"caption":"Web Hosting and IT Consultancy Services"},"image":{"@id":"https:\/\/www.ucartz.com\/updates\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/www.ucartz.com\/updates\/#\/schema\/person\/1ba9bfab02a76dee216c9f55bb634e56","name":"Alex Joseph","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/0969fa5fefa2739cbd6fd5eaf04fed619e19f40d42e4a42650090606944ff747?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/0969fa5fefa2739cbd6fd5eaf04fed619e19f40d42e4a42650090606944ff747?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/0969fa5fefa2739cbd6fd5eaf04fed619e19f40d42e4a42650090606944ff747?s=96&d=mm&r=g","caption":"Alex Joseph"},"description":"Alex Joseph is a Senior Support Staff professional with deep experience in server management, web hosting technologies, and cybersecurity operations. He works daily with Linux servers, cloud platforms, performance tuning, and security hardening, giving him strong real-world technical knowledge. Along with his support role, he write about security best practices, hosting infrastructure, and software management.","url":"https:\/\/www.ucartz.com\/updates\/author\/alexjoseph\/"}]}},"_links":{"self":[{"href":"https:\/\/www.ucartz.com\/updates\/wp-json\/wp\/v2\/posts\/3079","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.ucartz.com\/updates\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.ucartz.com\/updates\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.ucartz.com\/updates\/wp-json\/wp\/v2\/users\/17"}],"replies":[{"embeddable":true,"href":"https:\/\/www.ucartz.com\/updates\/wp-json\/wp\/v2\/comments?post=3079"}],"version-history":[{"count":0,"href":"https:\/\/www.ucartz.com\/updates\/wp-json\/wp\/v2\/posts\/3079\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.ucartz.com\/updates\/wp-json\/wp\/v2\/media?parent=3079"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.ucartz.com\/updates\/wp-json\/wp\/v2\/categories?post=3079"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.ucartz.com\/updates\/wp-json\/wp\/v2\/tags?post=3079"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}