---
id: "CVE-2026-115252"
page: "https://infrastack.ai/live/CVE-2026-115252"
kind: "vulnerability"
aliases: ["CVE-2026-115252"]
title: "WordPress Confection Cable plugin: unauthenticated PHP code execution via settings"
severity: "critical"
cvss: 10.0
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "php", "self-hosted", "wordpress"]
not_affected_if: ["plugin-not-installed"]
published_at: "2026-11-09T11:17:21+00:00"
first_seen_at: "2026-11-09T11:26:03+00:00"
updated_at: "2026-11-09T11:26:29+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-115252", "first_seen_at": "2026-11-09T11:26:03+00:00"}]
exploit_sources: []
---

# WordPress Confection Cable plugin: unauthenticated PHP code execution via settings

Link for people: https://infrastack.ai/live/CVE-2026-115252 (this .md is for agents)

The Confection Cable WordPress plugin, versions 0.4.0 through 0.4.7, saves settings without permission or nonce checks and writes one setting unmodified into a PHP file it serves. An unauthenticated attacker can make the server run arbitrary PHP code.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the Confection Cable plugin is installed and its version in the WordPress admin plugin list, or look for the plugin folder under `wp-content/plugins/`
- Look for PHP files created by the plugin in its folder or uploads directory that contain attacker-supplied code

## Fix

- Plugin versions after `0.4.7` are not named as fixed in the sources; check the vendor's release notes for the fixed version

## Timeline

- 2026-11-09T11:26:03+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-115252

## From the sources

The Confection WordPress Cable WordPress plugin from 0.4.0 to 0.4.7 does not perform any capability or nonce checks before saving its settings and writing one of them, unmodified, into a standalone PHP file that it then serves, allowing unauthenticated users to execute arbitrary PHP code on the server.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_