{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3aconfectionwordpress_cable/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:confection:wordpress_cable:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":10,"id":"CVE-2026-115252"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["WordPress Cable (0.4.0 - 0.4.7)"],"_cs_severities":["critical"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Confection"],"content_html":"\u003cp\u003eThe Confection WordPress Cable WordPress plugin (versions 0.4.0 to 0.4.7) does not perform capability or nonce checks before saving its settings. The plugin writes settings, unmodified, into a standalone PHP file that it then serves, allowing unauthenticated users to execute arbitrary PHP code on the server.\u003c/p\u003e\n","date_modified":"2026-11-09T11:40:25Z","date_published":"2026-11-09T11:40:25Z","id":"https://feed.craftedsignal.io/briefs/2026-11-confection-wordpress-cable-rce/","summary":"The Confection WordPress Cable plugin (versions 0.4.0 to 0.4.7) is vulnerable to unauthenticated remote code execution due to a lack of capability and nonce checks.","title":"Confection WordPress Cable: Unauthenticated Remote Code Execution (CVE-2026-115252)","url":"https://feed.craftedsignal.io/briefs/2026-11-confection-wordpress-cable-rce/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:confection:wordpress_cable:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}