WordPress Cable (0.4.0 - 0.4.7) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/wordpress-cable-0.4.0---0.4.7/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioMon, 09 Nov 2026 11:40:25 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgConfection WordPress Cable: Unauthenticated Remote Code Execution (CVE-2026-115252)https://feed.craftedsignal.io/briefs/2026-11-confection-wordpress-cable-rce/Mon, 09 Nov 2026 11:40:25 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-confection-wordpress-cable-rce/The Confection WordPress Cable plugin (versions 0.4.0 to 0.4.7) is vulnerable to unauthenticated remote code execution due to a lack of capability and nonce checks.<p>The Confection WordPress Cable WordPress plugin (versions 0.4.0 to 0.4.7) does not perform capability or nonce checks before saving its settings. The plugin writes settings, unmodified, into a standalone PHP file that it then serves, allowing unauthenticated users to execute arbitrary PHP code on the server.</p> criticaladvisory