CVE-2026-115252

CVE

Threat entity extracted from intelligence sources

Frequency

4

occurrences

First Seen

November 9, 2026

Last Seen

November 9, 2026

Exploited in Wild

—

Ransomware Use

—

Public Exploits

—

Attack Vector

—

Vulnerability Overview

Exploitation Activity

Exploitation Intelligence

Critical RCE Vulnerability in Confection WordPress Plugin (CVE-2026-115252)86.0

A critical vulnerability, CVE-2026-115252, has been identified in the Confection WordPress Cable plugin, affecting versions 0.4.0 to 0.4.7. This flaw allows unauthenticated attackers to execute arbitrary PHP code on the server by writing unmodified settings into a PHP file without proper checks. The...

Public Exploits

Checking GitHub for proof-of-concept code…

Related Clusters (1)

Critical RCE Vulnerability in Confection WordPress Plugin (CVE-2026-115252)

6h ago·1 sources

Related Articles (4)

CVE-2026-115252: from 0.4 Authentication Bypass - Analysis & Fix TheHackerWire / 4h Real-time tracking of CVSS 9.0+ remote execution zero-days, public exploit code, and ransomware-linked vulnerabilities disclosed this week. Security teams should monitor threat feeds for emerging developments and apply vendor patches proactively.

www.thehackerwire.com·6h ago

CVE-2026-115252 — Confection 0.4.0 - 0.4.7 - Unauthenticated RCE via Write Key Option Most recent entries from cvelistv5 / 3h Affected: Unknown Confection WordPress Cable The Confection WordPress Cable WordPress plugin from 0.4.0 to 0.4.7 does not perform any capability or nonce checks before saving its settings and writing one of them, unmodified, into a standalone PHP file that it then serves, allowing unauthenticated users to execute arbitrary PHP code on the server.

db.gcve.eu·6h ago

LocateRisk

locaterisk.com·6h ago

CVE-2026-115252 - Exploits & Severity

Related Entities

Zero-day Exploit Data Breach CWE-94 - Code Injection CWE-287 - Improper Authentication CWE-78 - OS Command Injection T1059 - Command and Scripting Interpreter T1190 - Exploit Public-Facing Application WordPress PHP