CVE-2026-115252

Summary

The Confection WordPress Cable plugin (versions 0.4.0–0.4.7) lacks capability and nonce checks when saving settings, allowing unauthenticated attackers to inject arbitrary PHP code by writing unsanitized input to a standalone PHP file that the plugin serves directly, leading to remote code execution.

Exploitability

Exploitation is trivial for unauthenticated attackers due to the absence of authentication, authorization, or CSRF protections.

Blast radius

Successful exploitation grants full server compromise, enabling complete data exfiltration, system modification, and lateral movement within the hosting environment.

Detection

Defenders should monitor for HTTP POST requests to wp-admin/admin-post.php or admin-ajax.php targeting the plugin’s settings endpoint (e.g., containing 'confection_cable' parameters) that result in the creation of new .php files in the wp-content/uploads/confection-cable/ directory, as evidenced by file creation events in web server access logs and filesystem audit logs.

Prioritized remediation

Upgrade to Confection WordPress Cable plugin version 0.4.8 or later; if unavailable, disable the plugin immediately and remove any generated PHP files in the plugin's upload directory.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.