{"affected":[{"defaultStatus":"unknown","ecosystem":"https://wordpress.org/plugins","product":"Confection WordPress Cable","source":"CNA: WPScan","vendor":"Unknown","versions":[{"lessThanOrEqual":"0.4.7","status":"affected","version":"0.4.0","versionType":"semver"}]}],"cveId":"CVE-2026-115252","cwes":["CWE-94","CWE-862"],"description":"The Confection WordPress Cable WordPress plugin from 0.4.0 to 0.4.7 does not perform any capability or nonce checks before saving its settings and writing one of them, unmodified, into a standalone PHP file that it then serves, allowing unauthenticated users to execute arbitrary PHP code on the server.","epss":null,"exploits":[{"kind":"exploit","source":"CNA: WPScan","url":"https://wpscan.com/vulnerability/aebe20c3-bc02-4082-bda8-bbaa01550925/"}],"kev":null,"metrics":[{"score":10,"severity":"critical","source":"CNA: WPScan","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},{"score":10,"severity":"critical","source":"NVD: contact@wpscan.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","version":"3.1"}],"modifiedAt":1794223041143,"publishedAt":1794219890507,"references":[{"source":"CNA: WPScan","tags":["exploit","vdb-entry","technical-description"],"url":"https://wpscan.com/vulnerability/aebe20c3-bc02-4082-bda8-bbaa01550925/"},{"source":"contact@wpscan.com","tags":[],"url":"https://wpscan.com/vulnerability/aebe20c3-bc02-4082-bda8-bbaa01550925/"}],"remediation":[],"revision":"71a638734929b0c524b8cc0b345545c4476376a00d5eb990c692d3ea23cfc8c2","sources":[{"modifiedAt":1794219890507,"name":"CNA: WPScan","retrievedAt":1794222512402,"url":"https://www.cve.org/CVERecord?id=CVE-2026-115252"},{"modifiedAt":1794223041143,"name":"NVD","retrievedAt":1794226704059,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115252"}],"ssvc":null,"status":"published","title":"Confection 0.4.0 - 0.4.7 - Unauthenticated RCE via Write Key Option","updatedAt":1794226704059}