Confection WordPress Cable: Unauthenticated Remote Code Execution (CVE-2026-115252)
The Confection WordPress Cable plugin (versions 0.4.0 to 0.4.7) is vulnerable to unauthenticated remote code execution due to a lack of capability and nonce checks.
CVE search metadata
CVE search record: CVE-2026-115252. Severity: critical. CVSS: 10.0. KEV: no. Product: WordPress Cable (0.4.0 - 0.4.7). Brief: Confection WordPress Cable: Unauthenticated Remote Code Execution (CVE-2026-115252). Brief link: https://feed.craftedsignal.io/briefs/2026-11-confection-wordpress-cable-rce/
Triage facts
Revision 1- Applicability
- WordPress Cable (0.4.0 - 0.4.7)
- Evidence
- Unknown
- Severity
- Critical
- Sources
- 1 public source
- Freshness
- Revision 1Nov 9, 11:40 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
The Confection WordPress Cable WordPress plugin (versions 0.4.0 to 0.4.7) does not perform capability or nonce checks before saving its settings. The plugin writes settings, unmodified, into a standalone PHP file that it then serves, allowing unauthenticated users to execute arbitrary PHP code on the server.