{"id":"CVE-2026-115252","kind":"vulnerability","aliases":["CVE-2026-115252"],"related":[],"title":"WordPress Confection Cable plugin: unauthenticated PHP code execution via settings","description":"The Confection WordPress Cable WordPress plugin from 0.4.0 to 0.4.7 does not perform any capability or nonce checks before saving its settings and writing one of them, unmodified, into a standalone PHP file that it then serves, allowing unauthenticated users to execute arbitrary PHP code on the server.","summary":"The Confection Cable WordPress plugin, versions 0.4.0 through 0.4.7, saves settings without permission or nonce checks and writes one setting unmodified into a PHP file it serves. An unauthenticated attacker can make the server run arbitrary PHP code.","severity":"critical","cvss":10.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","php","self-hosted","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check whether the Confection Cable plugin is installed and its version in the WordPress admin plugin list, or look for the plugin folder under `wp-content/plugins/`\n- Look for PHP files created by the plugin in its folder or uploads directory that contain attacker-supplied code","fix":"- Plugin versions after `0.4.7` are not named as fixed in the sources; check the vendor's release notes for the fixed version","status":"open","published_at":"2026-11-09T11:17:21+00:00","first_seen_at":"2026-11-09T11:26:03+00:00","triaged_at":"2026-11-09T11:26:29+00:00","updated_at":"2026-11-09T11:26:29+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-09T11:26:29Z","model":"claude-haiku-5-5","output":{"fix":"- Plugin versions after `0.4.7` are not named as fixed in the sources; check the vendor's release notes for the fixed version","reach":"internet","title":"WordPress Confection Cable plugin: unauthenticated PHP code execution via settings","impact":"high","summary":"The Confection Cable WordPress plugin, versions 0.4.0 through 0.4.7, saves settings without permission or nonce checks and writes one setting unmodified into a PHP file it serves. An unauthenticated attacker can make the server run arbitrary PHP code.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","self-hosted","php"],"confidence":0.8,"fix_status":"unknown","needs_auth":"no","worst_case":"Unauthenticated attacker runs arbitrary PHP code on the server","analyst_note":"Confirm the fixed version and whether the vulnerable settings path is on by default, using the plugin's WordPress.org page or the vendor's advisory.","how_to_check":"- Check whether the Confection Cable plugin is installed and its version in the WordPress admin plugin list, or look for the plugin folder under `wp-content/plugins/`\n- Look for PHP files created by the plugin in its folder or uploads directory that contain attacker-supplied code","plain_action":"","product_name":"Confection Cable","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Any WordPress site running the Confection Cable plugin in the 0.4.0 to 0.4.7 range is exposed, since the flaw needs no login. Sites that do not have the plugin installed, or run a version outside that range, are not affected. The sources do not say whether the flaw depends on a non-default setting.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000785,"input_tokens":4570,"output_tokens":656,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-115252':13A,16A '-2026':12A,15A '0.4.0':29B,68C '0.4.7':31B,70C 'allow':98C 'arbitrari':58B,103C 'attack':52B 'cabl':3A,25B,64C 'capabl':75C 'check':38B,78C 'code':7A,60B,105C 'confect':2A,24B,62C 'cve':11A,14A 'execut':8A,102C 'file':47B,93C 'host':21B 'make':54B 'nonc':37B,77C 'one':41B,85C 'packag':17B 'perform':73C 'permiss':35B 'php':6A,18B,46B,59B,92C,104C 'plugin':4A,27B,66C 'run':57B 'save':32B,80C 'self':20B 'self-host':19B 'serv':49B,97C 'server':56B,108C 'set':10A,33B,42B,82C 'standalon':91C 'unauthent':5A,51B,99C 'unmodifi':43B,88C 'user':100C 'version':28B 'via':9A 'without':34B 'wordpress':1A,22B,26B,63C,65C 'write':40B,84C","nicknames":[],"mitigations":[],"who_affected":"Any WordPress site running the Confection Cable plugin in the 0.4.0 to 0.4.7 range is exposed, since the flaw needs no login. Sites that do not have the plugin installed, or run a version outside that range, are not affected. The sources do not say whether the flaw depends on a non-default setting.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["critical","package","php","selfhosted","wordpress"],"campaign_type":null,"search_a":"'-115252':13A,16A '-2026':12A,15A 'cabl':3A 'code':7A 'confect':2A 'cve':11A,14A 'execut':8A 'php':6A 'plugin':4A 'set':10A 'unauthent':5A 'via':9A 'wordpress':1A","search_b":"'0.4.0':29B '0.4.7':31B 'arbitrari':58B 'attack':52B 'cabl':25B 'check':38B 'code':60B 'confect':24B 'file':47B 'host':21B 'make':54B 'nonc':37B 'one':41B 'packag':17B 'permiss':35B 'php':18B,46B,59B 'plugin':27B 'run':57B 'save':32B 'self':20B 'self-host':19B 'serv':49B 'server':56B 'set':33B,42B 'unauthent':51B 'unmodifi':43B 'version':28B 'without':34B 'wordpress':22B,26B 'write':40B","search_c":"'0.4.0':68C '0.4.7':70C 'allow':98C 'arbitrari':103C 'cabl':64C 'capabl':75C 'check':78C 'code':105C 'confect':62C 'execut':102C 'file':93C 'nonc':77C 'one':85C 'perform':73C 'php':92C,104C 'plugin':66C 'save':80C 'serv':97C 'server':108C 'set':82C 'standalon':91C 'unauthent':99C 'unmodifi':88C 'user':100C 'wordpress':63C,65C 'write':84C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T11:17:21+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cvss_by":"contact@wpscan.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115252","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115252","severity":null,"published_at":"2026-11-09T11:17:21+00:00","modified_at":"2026-11-09T11:17:21+00:00","first_seen_at":"2026-11-09T11:26:03+00:00","fetched_at":"2026-11-09T11:26:03+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}