CVE-2026-115252
The Confection WordPress Cable WordPress plugin from 0.4.0 to 0.4.7 does not perform any capability or nonce checks before saving its settings and writing one of them, unmodified, into a standalone PHP file that it then serves, allowing unauthenticated users…
- CVSS
- 10.0 Critical
- EPSS
- 0.4%
- Percentile
- 37
- Published
- 2026-11-09
- Force
- 6 of 12
- Public PoC
- 2
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H