{"metadata": {"vulnerability": "CVE-2026-115252", "count": 27, "kinds": {"milestone": 4, "sighting": 15, "kev": 0, "other": 8}, "linked_omitted": 0}, "data": [{"timestamp": "2026-10-22T08:37:57.008Z", "date_only": false, "value": "2026-10-22T08:37:57.008Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-115252", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-11-09T10:24:50.507Z", "date_only": false, "value": "2026-11-09T10:24:50.507Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-115252", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-11-09T10:24:50.507Z", "date_only": false, "value": "2026-11-09T10:24:50.507Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / WPScan", "record": "CVE-2026-115252", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-11-09T10:33:24.544Z", "date_only": false, "value": "2026-11-09T10:33:24.544412Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117586028402232074", "record": "CVE-2026-115252", "field": "creation_timestamp", "uuid": "4ad61638-baff-45da-bc6a-339d8a118847", "content": "CVE-2026-115252 Confection 0.4.0 - 0.4.7 - Unauthenticated RCE via Write Key Option The Confection WordPress Cable WordPress plugin from 0.4.0 to 0.4.7 does not perform any capability or nonce checks before saving its settings and writing one of them, unmodified, into a standalone PHP file that it then serves, allowing unauthenticated users to execute arbitrary PHP code on the server.\nhttps://www.cve.org/CVERecord?id=CVE-2026-115252https://wpscan.com/vulnerability/aebe20c3-bc02-4082-bda8-bbaa01550925/#CVE_2026_115252#bot", "url": "https://infosec.exchange/users/cve/statuses/117586028402232074"}, {"timestamp": "2026-11-09T11:00:03.889Z", "date_only": false, "value": "2026-11-09T11:00:03.889139Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mzurim7ass2h", "record": "CVE-2026-115252", "field": "creation_timestamp", "uuid": "a6a638b5-5a4a-4bff-a0ad-bc56463037b4", "content": "CVE-2026-115252 - confection wordpress cable\nThe Confection WordPress Cable add\u2011on (versions 0.4.0 through 0.4.7) saves its settings without checking who is making the change and writes one setting directly to a PHP\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#unknown #CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3mzurim7ass2h"}, {"timestamp": "2026-11-09T11:17:21Z", "date_only": false, "value": "2026-11-09T11:17:21Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-6CH9-PX9G-8JXJ", "record": "GHSA-6CH9-PX9G-8JXJ", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2026-11-09T11:17:21.143Z", "date_only": false, "value": "2026-11-09T11:17:21.143", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-115252", "record": "FKIE_CVE-2026-115252", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-09T11:30:54.760Z", "date_only": false, "value": "2026-11-09T11:30:54.760108Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/aiuto-ch.bsky.social/post/3mzut7pv6xcr6", "record": "CVE-2026-115252", "field": "creation_timestamp", "uuid": "03ad7387-a338-49fd-88b1-9cf39df39d6f", "content": "CVE Radar | CVE-2026-115252 | CVSS 10.0\n\nCritical Confection WordPress Plugin Code Execution\n\nCVE-2026-115252 affects Confection WordPress Cable plugin versions 0.4.0 through 0.4.7.\n\nFull analysis: https://t.me/aiutocomputerhelp_lab/1398", "url": "https://bsky.app/profile/aiuto-ch.bsky.social/post/3mzut7pv6xcr6"}, {"timestamp": "2026-11-09T12:31:42Z", "date_only": false, "value": "2026-11-09T12:31:42Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-6CH9-PX9G-8JXJ", "record": "GHSA-6CH9-PX9G-8JXJ", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-09T12:31:42Z", "date_only": false, "value": "2026-11-09T12:31:42Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-6CH9-PX9G-8JXJ", "record": "GHSA-6CH9-PX9G-8JXJ", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-09T13:41:49.610Z", "date_only": false, "value": "2026-11-09T13:41:49.610106Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-115252", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-11-09T13:41:49.610Z", "date_only": false, "value": "2026-11-09T13:41:49.610106Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-115252", "record": "FKIE_CVE-2026-115252", "field": "metrics.ssvcV203.0.ssvcData.timestamp", "linked_record": true}, {"timestamp": "2026-11-09T13:51:55.258Z", "date_only": false, "value": "2026-11-09T13:51:55.258Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-115252", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-11-09T13:51:55.258Z", "date_only": false, "value": "2026-11-09T13:51:55.258Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-115252", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-11-09T14:07:13.576Z", "date_only": false, "value": "2026-11-09T14:07:13.576600Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mzv3xbr62u2x", "record": "CVE-2026-115252", "field": "creation_timestamp", "uuid": "876fe07c-6978-44c6-b20c-ebec5b787328", "content": "\ud83d\udea8 CVE-2026-115252 \u2014 CVSS 10 CRITICAL\n\nThe Confection WordPress Cable WordPress plugin from 0.4.0 to 0.4.7 does not perform any capability or nonc...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-115252\n\n#CVE #CyberSecurity #InfoSec", "url": "https://bsky.app/profile/stemshop.bsky.social/post/3mzv3xbr62u2x"}, {"timestamp": "2026-11-10T00:00:13.507Z", "date_only": false, "value": "2026-11-10T00:00:13.507169Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/pulse-wp.com/post/3mzw53kvzzq25", "record": "CVE-2026-115252", "field": "creation_timestamp", "uuid": "5324826e-d714-4d4c-a257-538e4f1eeedf", "content": "CVE-2026-115252. CVSS 10/10. Confection WordPress Cable 0.4.0\u20130.4.7 writes arbitrary PHP to disk. Any visitor executes code as your server. No auth needed. No patch available. Disable the plugin now. Scan: pulse-wp.com\n#WordPress #CVE #CyberSecurity", "url": "https://bsky.app/profile/pulse-wp.com/post/3mzw53kvzzq25"}, {"timestamp": "2026-11-10T05:16:25Z", "date_only": false, "value": "2026-11-10T05:16:25.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/CyberDispatch/3691", "record": "CVE-2026-115252", "field": "creation_timestamp", "uuid": "3292a343-96a8-4102-be57-28ed6ed708f8", "content": "CRITICAL 10.0 \u00b7 Confection WordPress Cable: unauthenticated remote code execution in settings saving (CVE-2026-115252)\n\nAnyone on the network can run arbitrary PHP code on the server without logging in.\n\nNo patch yet \u00b7 affected: >=0.4.0 <=0.4.7", "url": "https://t.me/CyberDispatch/3691"}, {"timestamp": "2026-11-10T16:28:46.510Z", "date_only": false, "value": "2026-11-10T16:28:46.510", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-115252", "record": "FKIE_CVE-2026-115252", "field": "lastModified", "linked_record": true}, {"timestamp": "2026-11-11T14:08:33Z", "date_only": false, "value": "2026-11-11T14:08:33.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/110142", "record": "CVE-2026-115252", "field": "creation_timestamp", "uuid": "1c17928d-7e0a-4437-9c5c-f38d5466aa39", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #RCE #CVE #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a cve-2026-115252-wordpress-php-injection-rce\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Ghost-Bx1\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-11-11 14:03:41\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-115252 - WordPress Confection Plugin PHP Code Injection RCE | CVSS 10.0 | By Gh0st-Bx1\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/110142", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-11-11T15:00:15Z", "date_only": false, "value": "2026-11-11T15:00:15.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/9TksccXR13CBjf5elM9Tl8ura6Se5ICeYAdW8DqivYgKj5A", "record": "CVE-2026-115252", "field": "creation_timestamp", "uuid": "83cdad71-6345-496f-b0ab-27095a7bfa4c", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-11-11T15:00:15Z", "date_only": false, "value": "2026-11-11T15:00:15.000000Z", "kind": "sighting", "label": "Seen", "source": "Telegram/9TksccXR13CBjf5elM9Tl8ura6Se5ICeYAdW8DqivYgKj5A", "record": "CVE-2026-115252", "field": "creation_timestamp", "uuid": "0c7d36ee-c642-4466-a09a-8a201be1f9a1"}, {"timestamp": "2026-11-11T15:54:35.386Z", "date_only": false, "value": "2026-11-11T15:54:35.386807Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/eventmonitor.bsky.social/post/3n257kxbcgwx2", "record": "cve-2026-115252", "field": "creation_timestamp", "uuid": "f668c6b4-f253-485f-b9e3-fc63629a7d82", "content": "Developing: Critical Confection WordPress Cable Vulnerability (CVE-2026-115252)\nhttps://cyber.eventmonitor.net/incident/EM-20261111-GU5C/critical-confection-wordpress-cable-vulnerability-cve-2026-115252/\n#news #cybersecurity", "url": "https://bsky.app/profile/eventmonitor.bsky.social/post/3n257kxbcgwx2"}, {"timestamp": "2026-11-11T16:10:14Z", "date_only": false, "value": "2026-11-11T16:10:14.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/CCU0nx6CqbJFbmE3swDIWlkb3iaTwF5T3nz4sGpWa23SAyv5", "record": "CVE-2026-115252", "field": "creation_timestamp", "uuid": "7c9970c6-19ba-4999-929f-fb523b7ea8a5", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-11-11T16:10:14Z", "date_only": false, "value": "2026-11-11T16:10:14.000000Z", "kind": "sighting", "label": "Seen", "source": "Telegram/CCU0nx6CqbJFbmE3swDIWlkb3iaTwF5T3nz4sGpWa23SAyv5", "record": "CVE-2026-115252", "field": "creation_timestamp", "uuid": "d0c42f16-6af8-46bd-88d9-15fc796cb002"}, {"timestamp": "2026-11-11T21:00:04Z", "date_only": false, "value": "2026-11-11T21:00:04.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/U2bTCVzN--2sN7HtFJdzvYM-LuslLkypxbbdLOPasXb_xjc", "record": "CVE-2026-115252", "field": "creation_timestamp", "uuid": "e3174c41-c33e-4a98-84e3-5a1b7170a40d", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-11-11T21:00:04Z", "date_only": false, "value": "2026-11-11T21:00:04.000000Z", "kind": "sighting", "label": "Seen", "source": "Telegram/U2bTCVzN--2sN7HtFJdzvYM-LuslLkypxbbdLOPasXb_xjc", "record": "CVE-2026-115252", "field": "creation_timestamp", "uuid": "c4702a29-9f3f-41d0-8a2a-78f2c1af094f"}, {"timestamp": "2026-11-13T07:00:17Z", "date_only": false, "value": "2026-11-13T07:00:17.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/g2ASntKwCWczU_iir8L8kzm8rKGjyfwyM3J5UvvxnemWcso", "record": "CVE-2026-115252", "field": "creation_timestamp", "uuid": "4b2ca928-463e-4fa8-ab5a-7cdc43a1784f", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}], "metrics": {"as_of": "2026-11-13T18:21:39.243Z", "anchors": {"origin": {"timestamp": "2026-11-09T10:24:50.507Z", "date_only": false, "value": "2026-11-09T10:24:50.507Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-115252", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-11-09T10:24:50.507Z", "date_only": false, "value": "2026-11-09T10:24:50.507Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-115252", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": {"timestamp": "2026-11-11T14:08:33Z", "date_only": false, "value": "2026-11-11T14:08:33.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/110142", "record": "CVE-2026-115252", "field": "creation_timestamp", "uuid": "1c17928d-7e0a-4437-9c5c-f38d5466aa39", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #RCE #CVE #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a cve-2026-115252-wordpress-php-injection-rce\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Ghost-Bx1\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-11-11 14:03:41\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-115252 - WordPress Confection Plugin PHP Code Injection RCE | CVSS 10.0 | By Gh0st-Bx1\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/110142", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": true, "seconds": 186222.493, "hours": 51.728470277777774, "days": 2.1553529282407404, "min_seconds": 186222.493, "max_seconds": 186222.493, "approximate": false, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-11-09T10:24:50.507Z", "date_only": false, "value": "2026-11-09T10:24:50.507Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-115252", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-11T14:08:33Z", "date_only": false, "value": "2026-11-11T14:08:33.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/110142", "record": "CVE-2026-115252", "field": "creation_timestamp", "uuid": "1c17928d-7e0a-4437-9c5c-f38d5466aa39", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #RCE #CVE #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a cve-2026-115252-wordpress-php-injection-rce\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Ghost-Bx1\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-11-11 14:03:41\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-115252 - WordPress Confection Plugin PHP Code Injection RCE | CVSS 10.0 | By Gh0st-Bx1\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/110142", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 374208.736076, "hours": 103.94687113222221, "days": 4.331119630509259, "min_seconds": 374208.736076, "max_seconds": 374208.736076, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-11-09T10:24:50.507Z", "date_only": false, "value": "2026-11-09T10:24:50.507Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-115252", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-13T18:21:39.243Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": true, "seconds": 187986.243076, "hours": 52.21840085444445, "days": 2.1757667022685188, "min_seconds": 187986.243076, "max_seconds": 187986.243076, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-11-11T14:08:33Z", "date_only": false, "value": "2026-11-11T14:08:33.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/110142", "record": "CVE-2026-115252", "field": "creation_timestamp", "uuid": "1c17928d-7e0a-4437-9c5c-f38d5466aa39", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #RCE #CVE #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a cve-2026-115252-wordpress-php-injection-rce\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Ghost-Bx1\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-11-11 14:03:41\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-115252 - WordPress Confection Plugin PHP Code Injection RCE | CVSS 10.0 | By Gh0st-Bx1\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/110142", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "end": {"timestamp": "2026-11-13T18:21:39.243Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}}}