Introduction
In its affected releases, a small WordPress integration plugin lets any anonymous visitor turn a settings value into PHP code that the server executes. No fixed release has been documented, and the version currently listed on WordPress.org falls inside the affected range, so sites running Confection WordPress Cable have no upgrade path that resolves the issue today.
Confection WordPress Cable is the WordPress integration for Confection (confection.io), which a business directory describes as a United States data management and privacy solutions provider founded in 2020. The plugin installs Confection on a WordPress site by adding a Confection administration menu where a user enters an account ID and saves settings. Its documented footprint is modest, with WordPress.org listing 10+ active installations. It is still a clear example of a vendor integration plugin where settings handling sits directly on the path to code the server runs.
Technical information
Root cause
WPScan titles the issue "Unauthenticated RCE via Write Key Option." Based on the advisory, the vulnerability is a chain of two failures:
- The plugin performs no capability checks and no nonce checks before saving its settings. A request that reaches the save logic is processed regardless of who sent it, including requests from unauthenticated users.
- One of the saved settings is written, unmodified, into a standalone PHP file, which the plugin then serves. Because the file is PHP, the server interprets its contents as code rather than treating them as data.
The second step is what makes this remote code execution rather than an unauthorized configuration change. Missing authorization alone would let an attacker alter plugin settings. Writing that value verbatim into an executable file turns attacker-controlled input into server-side code.
Our source material lists no CWE, but the published CVE record maps the issue to CWE-94, Improper Control of Generation of Code, and CWE-862, Missing Authorization. WPScan separately lists CWE-94.
Capability checks versus nonces
The advisory notes that both capability and nonce checks are absent. WordPress documentation states that nonces help protect against attacks such as CSRF but must never be relied on for authentication, authorization, or access control, and it directs developers to protect functions with current_user_can(). A fix that adds only a nonce would therefore leave the authorization failure described here in place.
Attack flow
Based on the WPScan description, exploitation follows this sequence:
- The attacker targets a WordPress site running Confection WordPress Cable 0.4.0 through 0.4.7.
- The attacker sends an unauthenticated request to the plugin's settings save functionality, placing PHP code in the affected setting.
- The plugin saves the setting without verifying the requester's capabilities or a nonce.
- The plugin writes that setting, unchanged, into its standalone PHP file.
- The plugin serves the generated file, and the server executes the injected PHP code.
No account, prior foothold, or user interaction is required at any stage.
What the advisory does not disclose
The public advisory does not identify the vulnerable endpoint, HTTP method, request parameter, generated PHP filename, file path, or vulnerable function. "Write Key Option" is the advisory's label, not a confirmed parameter name. WPScan is withholding its proof of concept until February 04, 2027, so this summary describes the architecture of the flaw rather than a reproducible request.
Severity
WPScan, as CNA, published the following vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
This reflects network attack vector, low complexity, no privileges, no user interaction, changed scope, and high confidentiality, integrity, and availability impact, for a score of 10.0 Critical. NVD displays this CNA assessment but has not provided its own score, so the rating should be attributed to WPScan rather than NIST.
Affected systems and versions
- Product: Confection WordPress Cable plugin for WordPress (WordPress.org slug: confection)
- Affected versions: 0.4.0 through 0.4.7
- Latest listed version on WordPress.org: 0.4.7, which is inside the affected range
- Fixed version: none known. WPScan states "No known fix" and the CVE record lists no fixed version
- Vulnerable configuration: any installation of an affected version, with no authentication required for exploitation
- Listed requirements: WordPress 5.0 or higher, PHP 5.6 or higher
Remediation status
Because 0.4.7 is affected, "update to the latest version" is not a valid remediation for this CVE. StackFlag's guidance is to update to a version where the missing check has been added, or to remove the plugin until it is fixed. At the time of writing, removal is the only action with explicit source support. Before reinstalling, use the vendor and advisory links below to confirm that a release explicitly addresses CVE-2026-115252.
Exploitation status
StackFlag labels the issue "Not known to be exploited," and VulDB states that no exploit is available. No threat actor, campaign, or indicator of compromise has been attributed. Naoki Kawahigashi is credited as the researcher. The CISA KEV snapshot we reviewed (version 2026.11.06) predates NVD publication, so current KEV status is unconfirmed. The absence of public exploit material does not rule out private use of an unauthenticated flaw.
Key dates:
- October 22, 2026: CVE reserved
- November 06, 2026: WPScan advisory published
- November 07, 2026: WPScan advisory last updated
- November 09, 2026: CVE record and NVD entry published
- February 04, 2027: WPScan proof of concept scheduled for display
Vendor security history
The CVE record lists the vendor as Unknown, while WordPress.org attributes the plugin to Confection (profile @getconfection). We found no other documented vulnerability history, vendor acknowledgement, or security release for this product. WordPress.org shows the plugin as last updated roughly three years ago and warns that it has not been tested with the latest three major WordPress releases and may no longer be maintained or supported. Together with the lack of a documented fix, these maintenance indicators are the most relevant signal for teams deciding whether to keep the plugin installed.
References
- NVD entry for CVE-2026-115252
- Official CVE record for CVE-2026-115252
- WPScan advisory: Confection 0.4.0 to 0.4.7, Unauthenticated RCE via Write Key Option
- Confection WordPress Cable on WordPress.org
- Confection publisher profile on WordPress.org
- StackFlag summary of CVE-2026-115252
- VulDB entry 433094
- CISA Known Exploited Vulnerabilities feed
- WordPress Developer Resources: Nonces
- WordPress Developer Resources: Checking User Capabilities
- Confection vendor website
