Plex Media Server plugin abuse exploited in the wild (CVE-2026-96654)

Actively exploited in the wild - CVE-2026-96654 is a medium-severity input-handling flaw in Plex Media Server before 1.43.3.10861 that lets a network attacker invoke other plugins’ functions with attacker-controlled parameters. Patched in 1.43.3.10861; update immediately.

Overview

Plex Media Server passes URL values through a parameter it calls searchOne without properly neutralizing them. Because the value is not correctly sanitized, an attacker can craft a request that causes the server to call functions belonging to a different plugin than the one intended, and to supply their own arguments to those calls.

In practical terms, the server trusts the caller to stay inside one plugin’s boundary, and this flaw breaks that boundary. Requests can reach across plugins and drive functionality the attacker was never meant to touch. The CVSS score is 6.9 (MEDIUM), with a vector of network reachable, low complexity, no privileges required, and no user interaction. That combination means anyone who can reach the server over the network can attempt it without an account and without tricking a user into clicking anything.

Impact

The direct consequence is cross-plugin function invocation. What an attacker can achieve depends on which plugin functions are reachable and what parameters they accept, so the blast radius varies by installation. In the worst case this enables actions outside the intended plugin scope, including data exposure or state changes on the media server. Because the exploit path requires no authentication and no user interaction, exposed Plex instances are the primary concern. CISA has added this CVE to its Known Exploited Vulnerabilities catalog, confirming that exploitation has occurred in the wild rather than remaining theoretical.

Remediation and Mitigation

• Upgrade Plex Media Server to 1.43.3.10861 or later. This is the only complete fix.
• If you cannot upgrade immediately, restrict network access to the Plex web and API ports to trusted networks only, and avoid exposing the server directly to the internet.
• Review server logs for unusual cross-plugin API requests or unexpected parameter patterns, particularly from unfamiliar source addresses.
• Treat any media server reachable from the open internet as higher risk and prioritize it for patching.

Exposure details from past incidents are catalogued in our breach reports, and current threat activity is tracked in our security news.

Security Insight

This CVE is a reminder that plugin architectures concentrate risk at the boundary between components: the server applies trust where it should apply validation, and one unsanitized parameter opens the whole plugin surface. It echoes earlier PHP and CMS plugin-boundary bugs where a single entry point let callers reach functions they had no business invoking. For self-hosted media servers, most of which sit on home and small-office networks with generous inbound rules, the gap between a medium score and real-world exploitation is small - and CISA KEV confirms attackers found it worth their time.

Further Reading

• All Medium Vulnerabilities
• Recent Critical Vulnerabilities
• Top Critical CVEs