# CVE-2025-66430: Plesk 18.0 has Incorrect Access Control.

Source: https://junglewise.ai/threats/cve-2025-66430-plesk-18-0-has-incorrect-access-control  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-12-12  
License: CC BY 4.0 with a link back

CVE-2025-66430 · Severity: critical · CVSS 9.1 · Published 2025-12-12

Plesk 18.0 has Incorrect Access Control.

Technologies: [Plesk](https://junglewise.ai/threats/technologies/plesk). Vendors: [Plesk](https://junglewise.ai/threats/vendors/plesk).

## Quick answers

**Is CVE-2025-66430 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-66430 being exploited in the wild.

**How severe is CVE-2025-66430?** Critical severity, with a CVSS score of 9.1, published 12 December 2025.

**Which products and versions are affected?** Plesk. The advisory does not name versions.

**Is there a fix for CVE-2025-66430?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**Am I affected by CVE-2025-66430?** Check whether you run Plesk. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Affected products

- Plesk

## Related threats

- [Plesk OS command injection allows remote code execution](https://junglewise.ai/threats/cve-2026-87898-os-command-injection-in-plesk-allows-remote-authenticated-users)
- [Plesk untrusted search path arbitrary code execution](https://junglewise.ai/threats/cve-2026-68492-an-untrusted-search-path-vulnerability-in-plesk-from-18-0-34)
- [Plesk TOCTOU race condition in symlink following](https://junglewise.ai/threats/cve-2026-68488-plesk-toctou-race-condition-in-symlink-following)
- [Plesk path traversal leading to arbitrary code execution as root](https://junglewise.ai/threats/cve-2026-67397-plesk-path-traversal-leading-to-arbitrary-code-execution-as-root)
- [Plesk symlink resolution vulnerability in file access](https://junglewise.ai/threats/cve-2026-65647-plesk-symlink-resolution-vulnerability-in-file-access)