{"id":"CVE-2026-115252","published":"2026-11-09T11:17:21.143","lastModified":"2026-11-10T16:28:46.510","description":"The Confection WordPress Cable WordPress plugin from 0.4.0 to 0.4.7 does not perform any capability or nonce checks before saving its settings and writing one of them, unmodified, into a standalone PHP file that it then serves, allowing unauthenticated users to execute arbitrary PHP code on the server.","cvssScore":10,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-94"],"vendors":[],"products":[],"references":[{"url":"https://wpscan.com/vulnerability/aebe20c3-bc02-4082-bda8-bbaa01550925/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The Confection WordPress Cable plugin (versions 0.4.0–0.4.7) lacks capability and nonce checks when saving settings, allowing unauthenticated attackers to inject arbitrary PHP code by writing unsanitized input to a standalone PHP file that the plugin serves directly, leading to remote code execution.","exploitability":"Exploitation is trivial for unauthenticated attackers due to the absence of authentication, authorization, or CSRF protections.","blast_radius":"Successful exploitation grants full server compromise, enabling complete data exfiltration, system modification, and lateral movement within the hosting environment.","remediation":"Upgrade to Confection WordPress Cable plugin version 0.4.8 or later; if unavailable, disable the plugin immediately and remove any generated PHP files in the plugin's upload directory.","detection":"Defenders should monitor for HTTP POST requests to wp-admin/admin-post.php or admin-ajax.php targeting the plugin’s settings endpoint (e.g., containing 'confection_cable' parameters) that result in the creation of new .php files in the wp-content/uploads/confection-cable/ directory, as evidenced by file creation events in web server access logs and filesystem audit logs.","tags":["rce","auth-bypass","web","wordpress","file-write","unauth"],"model":"garnet-coder","analyzedAt":"2026-11-10T09:41:08.608Z"}}