Confection WordPress Cable Plugin Arbitrary PHP Code Execution Vulnerability

The Confection WordPress Cable WordPress plugin from 0.4.0 to 0.4.7 contains an arbitrary PHP code execution vulnerability.

The plugin does not perform any capability or nonce checks before saving its settings, and writes one of them unmodified into a standalone PHP file that it then serves. This allows unauthenticated users to execute arbitrary PHP code on the server.