CVE-2026-115252: Confection 0.4.0 - 0.4.7 - Unauthenticated RCE via Write Key Option
Published Nov 9, 2026
·Updated
The Confection WordPress Cable WordPress plugin from 0.4.0 to 0.4.7 does not perform any capability or nonce checks before saving its settings and writing one of them, unmodified, into a standalone PHP file that it then serves, allowing unauthenticated users to execute arbitrary PHP code on the server.
Affected Software
0 affected components
Event History
Nov 9, 2026
CVE Published
via MITRE·10:24 AM
Data Sourced
via MITRE·10:24 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Who can exploit this issue?
Any unauthenticated remote user can exploit it. No WordPress account, capability, nonce, or user interaction is required.
2
What access does successful exploitation provide?
Successful exploitation allows arbitrary PHP code execution on the server. The stated impact includes high confidentiality, integrity, and availability impact.
3
Which plugin versions are affected?
Confection WordPress Cable versions 0.4.0 through 0.4.7 are affected.