Confection

The Confection WordPress Cable plugin (versions 0.4.0 to 0.4.7) is vulnerable to unauthenticated remote code execution due to a lack of capability and nonce checks.