CVE-2026-115252 is a critical vulnerability in the WordPress plugin Confection WordPress Cable, rated with CVSS 10.0. The plugin writes a setting unchanged into an executable PHP file without checking permissions or a nonce value, allowing unauthenticated attackers to execute arbitrary PHP code on the server.
This affects all versions from 0.4.0 to 0.4.7 inclusive. At the time of publication, no patch is available. Organizations should deactivate or remove the plugin until a clean version is provided and monitor the WordPress plugin directory for a new version.
WPScan classifies CVE-2026-115252 as actively exploited. Operators should immediately deactivate or remove the plugin, restrict access to plugin settings endpoints via a Web Application Firewall or .htaccess block and prioritize mitigating affected systems. As soon as a cleaned version is released, an immediate update is required.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
