Skip to content
Critical RCE Vulnerability in Confection WordPress Plugin (CVE-2026-115252)

Critical RCE Vulnerability in Confection WordPress Plugin (CVE-2026-115252)

First seen 9 Nov 2026, 17:38 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •November 9, 2026 at 17:38 UTC
  • •CVE-2026-115252 allows unauthenticated RCE in Confection plugin versions 0.4.0-0.4.7.
  • •The vulnerability has a CVSS score of 10.0, indicating critical severity.
  • •No patch is currently available; organizations should deactivate the plugin immediately.

A critical vulnerability, CVE-2026-115252, has been identified in the Confection WordPress Cable plugin, affecting versions 0.4.0 to 0.4.7. This flaw allows unauthenticated attackers to execute arbitrary PHP code on the server by writing unmodified settings into a PHP file without proper checks. The vulnerability has a CVSS score of 10.0, indicating its critical nature. Currently, there is no patch available, and the vulnerability is classified as according to WPScan. Security experts recommend deactivating or removing the plugin until a fix is released and monitoring for suspicious activity. The vulnerability was publicly disclosed on November 9, 2026, and multiple sources have corroborated its existence and severity.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 6h ago How this analysis works

Timeline

2026-11-09
CVE-2026-115252 published
The vulnerability in the Confection WordPress Cable plugin was disclosed, allowing RCE without authentication.
Feedly
2026-11-09
Active exploitation reported
WPScan classified CVE-2026-115252 as actively exploited, urging immediate action from users.
LocateRisk

More articles in this cluster (5)

Following this threat?

Track CVE-2026-115252 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (6)

1 / 4

Common questions

Which versions of the Confection plugin are affected?
Versions 0.4.0 through 0.4.7 of the Confection WordPress Cable plugin are affected.
Is there a patch available for this vulnerability?
No, there is currently no patch available for CVE-2026-115252.
What immediate actions should be taken?
Organizations should deactivate or remove the Confection plugin and monitor for any signs of exploitation.