The Confection WordPress Cable plugin fails to perform capability or nonce checks when saving its settings. It writes one setting value directly into a standalone PHP file that the plugin serves, allowing any unauthenticated user to inject arbitrary PHP code and execute it on the server. This flaw enables attackers to compromise confidentiality, integrity, and availability by running arbitrary commands or installing malware, potentially resulting in full system takeover.

WordPress sites running the Confection WordPress Cable plugin version 0.4.0 through 0.4.7 are affected. The vendor is listed as Unknown:Confection WordPress Cable on platforms that host the plugin.

The vulnerability has a CVSS score of 10, indicating critical severity. No EPSS score is currently available, but the attack can be launched without authentication or special privileges, and the code payload is directly executed by the server. The flaw is not yet included in the CISA KEV catalog, though the potential impact and ease of exploitation justify immediate attention. Attackers can trigger the flaw by accessing the plugin’s write‑key endpoint with crafted input, resulting in the creation of a malicious PHP file that the plugin will serve to any visitor.