https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-11-10T15:06:14.601317+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/cve-2026-115252 CVE-2026-115252 — Confection 0.4.0 - 0.4.7 - Unauthenticated RCE via Write Key Option 2026-11-10T15:06:14.614386+00:00

Affected: Unknown Confection WordPress Cable

The Confection WordPress Cable WordPress plugin from 0.4.0 to 0.4.7 does not perform any capability or nonce checks before saving its settings and writing one of them, unmodified, into a standalone PHP file that it then serves, allowing unauthenticated users to execute arbitrary PHP code on the server.