A comment questioning if this was CVE-2012-1823 was apparently deleted by it's author. I agree that it does look similar. The exploit author actually addresses this the plesk-remarks.txt file - "Furthermore this is not cve-2012-1823 because the php interpreter is called directly".