CVE-2026-115252 · Package
NO FIX YET · SEE WHAT TO DO
The Confection Cable WordPress plugin, versions 0.4.0 through 0.4.7, saves settings without permission or nonce checks and writes one setting unmodified into a PHP file it serves. An unauthenticated attacker can make the server run arbitrary PHP code.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Any WordPress site running the Confection Cable plugin in the 0.4.0 to 0.4.7 range is exposed, since the flaw needs no login. Sites that do not have the plugin installed, or run a version outside that range, are not affected. The sources do not say whether the flaw depends on a non-default setting.
Not affected if plugin-not-installed
Who cares php, self-hosted, wordpress
wp-content/plugins/0.4.7 are not named as fixed in the sources; check the vendor's release notes for the fixed versionThe Confection WordPress Cable WordPress plugin from 0.4.0 to 0.4.7 does not perform any capability or nonce checks before saving its settings and writing one of them, unmodified, into a standalone PHP file that it then serves, allowing unauthenticated users to execute arbitrary PHP code on the server.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.