Unauthenticated RCE in Confection WordPress Cable 0.4.0-0.4.7: the plugin saves settings without capability or nonce checks and writes one option unmodified into a standalone served .php file, enabling arbitrary PHP execution over the network. Remove/disable the plugin and block access to its settings endpoint. No patch, WordPress.org closed the plugin as of 2026-10-23 (temporary closure).