Confection 0.4.0 - 0.4.7 - Unauthenticated RCE via Write Key Option
Not on CISA's list of exploited flaws, and not in the news we track.
10.0of 10, critical
Fix it in your code
Each opens with a short prompt that points at Global Hack Map's public runbook for CVE-2026-115252. Nothing runs until you send it.
The Confection WordPress Cable WordPress plugin from 0.4.0 to 0.4.7 does not perform any capability or nonce checks before saving its settings and writing one of them, unmodified, into a standalone PHP file that it then serves, allowing unauthenticated users to execute arbitrary PHP code on the server.