The Confection WordPress Cable WordPress plugin versions 0.4.0 through 0.4.7 lacks capability and nonce checks when saving settings. One setting is written unmodified into a standalone PHP file that is then served by the plugin, allowing arbitrary PHP code execution on the server.
An unauthenticated attacker over the network can execute arbitrary PHP code on the server with the privileges of the web server process.
There is no evidence that a public proof-of-concept exists. Its exploitation has been reported by various sources, including locaterisk.com.
Update the Confection WordPress Cable plugin to a version newer than 0.4.7. Disable or remove the plugin if an update is not immediately available. Implement network-level access controls to restrict who can interact with the vulnerable plugin endpoints. Monitor web server logs for suspicious POST requests to the plugin's settings endpoints.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Feedly found the first article mentioning CVE-2026-115252 . See article
NVD published the first details for CVE-2026-115252
A CVSS base score of 10 has been assigned.
GitHub Advisories released a security advisory .
Attacks in the wild have been reported by LocateRisk . See article
[GHSA-6ch9-px9g-8jxj] The Confection WordPress Cable WordPress plugin from 0.4.0 to 0.4.7 does not per
CVE-2026-115252 - Exploits & Severity - Feedly
CVE-2026-115252: PHP Code Execution in Confection WordPress Cable - LocateRisk
CVE-2026-115252 — Confection 0.4.0 - 0.4.7 - Unauthenticated RCE via Write Key Option
15 changes (0 new | 15 updated):
CVE-2026-115252: from 0.4 Authentication Bypass - Analysis & Fix
Be the first to know critical vulnerabilities
Collect, analyze, and vulnerability reports faster using AI
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
