CVE-2026-115252

The Confection WordPress Cable plugin (versions 0.4.0 to 0.4.7 ) contains a vulnerability allowing unauthenticated remote code execution (RCE) . The root cause is a lack of capability or nonce checks when saving settings. Specifically, the plugin writes one of the settings, unmodified, into a sta...