Fiber Admin CVEs and Security Vulnerabilities

CVE-2026-121491

Fiber Admin 3.1.0 - 4.0.0 - Unauthenticated RCE via Host Header

The Fiber Admin WordPress plugin before 4.0.1 does not validate or escape a request header before writing it into a PHP file it regenerates on an unprotected admin hook, allowing unauthenticated attackers to execute arbitrary code when its custom database error page is enabled and they win a race against an administrator saving its settings.

CVSS 3.1 · 9.0 Critical EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Fiber Admin

CVE-2026-121492

Fiber Admin < 4.0.1 - Unauthenticated Arbitrary Post and Term Order Modification via fiad_cpo_update and fiad_cpo_tax_update

The Fiber Admin WordPress plugin before 4.0.1 does not have authorisation checks in some of its AJAX actions, allowing unauthenticated users to change the order of arbitrary posts, including drafts, private posts and navigation menu items, as well as the order of taxonomy terms when term ordering is enabled.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed