CVE-2026-115252: PHP Code Execution in Plugin Confection WordPress Cable
This text was generated using artificial intelligence (AI).WPScan documents with CVE-2026-115252 a critical vulnerability in the WordPress plugin Confection WordPress Cable. Affected are versions 0.4.0 to 0.4.7. The vulnerability allows unauthenticated attackers to execute arbitrary PHP code on the server. WPScan classifies CVE-2026-115252 as actively exploited.
The vulnerability is classified with CVSS 10.0 assessed. The published CVSS vector indicates a network attack with low attack complexity, without required privileges and without user interaction.
This affects Confection WordPress Cable in the following versions:
0.4.0
0.4.1
0.4.2
0.4.3
0.4.4
0.4.5
0.4.6
0.4.7
The plugin is distributed via the WordPress.org plugin repository. The attack requires neither a login nor interaction by users.
Technical Cause of the Vulnerability
According to WPScan, the plugin does not check permissions or a nonce value before saving its settings. A setting is written unchanged to a standalone PHP file, which is then served by the server.
This processing allows unauthenticated attackers to execute PHP code on an affected web server. The vulnerability falls under the categories CWE-94 and CWE-862 .
Measures for Risk Mitigation
No patched version is available for the affected versions. Since WPScan classifies the vulnerability as actively exploited, organizations should take immediate action and prioritize affected systems.
Appropriate measures are:
Deactivate or remove the plugin.
Block access to plugin settings endpoints server-side, for example via a Web Application Firewall or .htaccess.
Prioritize and mitigate affected systems.
Check the WordPress plugin directory for a new version as soon as the vendor publishes a fix.
Continuously conduct vulnerability and vendor risk monitoring for deployed plugins.
WordPress operators in Germany and Austria who fall under NIS-2 or the Austrian NISG should immediately check the impact on their WordPress infrastructure. If successful exploitation leads to access to personal data, a reporting obligation under GDPR Art. 33 with a 72-hour deadline to the competent supervisory authority may be triggered. For Swiss organizations, the revised Information Security Act (ISG) applies with a reporting obligation to BACS.
Visibility of Externally Accessible WordPress Systems
WordPress instances with the plugin may be accessible under a corporate domain. The plugin can be detected on externally accessible systems based on public paths or response patterns.
External Attack Surface Management helps to make external assets and web applications visible and to prioritize the examination of affected systems. LocateRisk makes external assets and deployed software visible. The specific vulnerable plugin version is therefore not necessarily determined. For CVE-2026-115252, a technical validation on the identified WordPress systems remains necessary, including plugin status and configuration.
Am I affected?
This affects Confection WordPress Cable in the versions mentioned above. Those who want to know if Confection WordPress Cable is visible in their externally accessible infrastructure can use the CVE Quick Check Use the tool at the end of this article: It shows exposed systems and the software that is visible from the outside.
It is not always possible to determine the specific version that has been installed from the outside—the key factor is comparing it with the manufacturer's advisory.
CVE-2026-115252 is a critical vulnerability in the WordPress plugin Confection WordPress Cable, rated with CVSS 10.0. The plugin writes a setting unchanged into an executable PHP file without checking permissions or a nonce value, allowing unauthenticated attackers to execute arbitrary PHP code on the server.
This affects all versions from 0.4.0 to 0.4.7 inclusive. At the time of publication, no patch is available. Organizations should deactivate or remove the plugin until a clean version is provided and monitor the WordPress plugin directory for a new version.
WPScan classifies CVE-2026-115252 as actively exploited. Operators should immediately deactivate or remove the plugin, restrict access to plugin settings endpoints via a Web Application Firewall or .htaccess block and prioritize mitigating affected systems. As soon as a cleaned version is released, an immediate update is required.
Status: November 09, 2026. This article is for general information purposes and is not legal, security, or action advice in individual cases. Security situation and patch availability may have changed since publication; the linked manufacturer advisory is always decisive. Despite careful research, we do not guarantee the timeliness, accuracy, and completeness.
CVE Quick Check
In just a few minutes, check whether there are any indications of a current CVE on your externally visible attack surface.
Initial assessment in just a few minutes via email.
Learn more during a free consultation with a LocateRisk consultant.
You'll receive this by email
companyYour Company, LLC
Verified CVECVE-2026-115252
Passive Assessment
Information About the CVEfound or not found
Want to find out more, book a demo or simply exchange ideas? We look forward to hearing from you!
We use cookies to optimize our website and our service.
Functional
Always active
Technical storage or access is strictly necessary for the lawful purpose of enabling the use of a particular service expressly requested by the subscriber or user, or for the sole purpose of carrying out the transmission of a message over an electronic communications network.
Preferences
The technical storage or access is necessary for the legitimate purpose of storing preferences that have not been requested by the subscriber or user.
Statistics
The technical storage or access, which is carried out exclusively for statistical purposes.Technical storage or access used solely for anonymous statistical purposes. Without a subpoena, the voluntary consent of your Internet service provider, or additional records from third parties, information stored or accessed for this purpose alone generally cannot be used to identify you.
Marketing
Technical storage or access is necessary to create user profiles, to send advertisements, or to track the user on a website or across multiple websites for similar marketing purposes.
English 
Deutsch 
Français