Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
10.0

Confection WordPress Cable plugin lets anyone run code

CVE-2026-115252 · published 1 day ago
Summary

The Confection WordPress Cable add‑on (versions 0.4.0 through 0.4.7) saves its settings without checking who is making the change and writes one setting directly to a PHP file that is then served. Because of this, anyone on the internet can cause the server to run whatever code they want, potentially taking control of the site. Update the plugin to a version where this check is added or remove the plugin until it is fixed.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
unknown confection wordpress cable <= 0.4.7
Original advisory text
Confection 0.4.0 - 0.4.7 - Unauthenticated RCE via Write Key Option
The Confection WordPress Cable WordPress plugin from 0.4.0 to 0.4.7 does not perform any capability or nonce checks before saving its settings and writing one of them, unmodified, into a standalone PHP file that it then serves, allowing unauthenticated users to execute arbitrary PHP code on the server.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
10.0 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-94Code Injection
CWE-862Missing Authorization
Timeline
Published9 Nov 2026
Updated10 Nov 2026
First seen9 Nov 2026
Sources
CVE-2026-115252 · NVD
CVE-2026-115252 · MITRE
Track software like this
Free during beta