CVE WATCH / VULNERABILITY DETAIL
CVE-2026-115252
CRITICALCVSS 10NVD feed
Published 9 November 2026 · tracked since 9 November 2026
Description
The Confection WordPress Cable WordPress plugin from 0.4.0 to 0.4.7 does not perform any capability or nonce checks before saving its settings and writing one of them, unmodified, into a standalone PHP file that it then serves, allowing unauthenticated users to execute arbitrary PHP code on the serv
References
- NVD — National Vulnerability Database
- CVE.org record (MITRE)
- CISA Known Exploited Vulnerabilities catalog
Latest tracked vulnerabilities
- CVE-2026-124684 MEDIUM 5.1
- CVE-2026-124591 MEDIUM 5.5
- CVE-2026-123460 HIGH 7.1
- CVE-2026-120838 MEDIUM 6.5
- CVE-2026-120367 HIGH 7.5
- CVE-2026-113702 MEDIUM 4.3
- CVE-2026-106466 HIGH 7.5
- CVE-2026-106008 MEDIUM 5.3
- CVE-2026-121764 HIGH 7.1
- CVE-2026-111453 MEDIUM 4.3