CVE-2026-121491 · Package
NO FIX YET · SEE WHAT TO DO
The Fiber Admin WordPress plugin writes an unvalidated request header into a PHP file it regenerates, so the header content becomes code the server runs. An unauthenticated attacker can execute arbitrary code if the custom database error page is enabled and they win a race against an administrator saving the plugin settings.
first public Nov 7, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Sites running the Fiber Admin WordPress plugin before 4.0.1 with the custom database error page enabled are exposed. Sites without the plugin, on a fixed version, or with that error page disabled are not affected by the sources' description. The attack depends on a race with an administrator saving settings, which makes exploitation harder but still possible.
Not affected if error-page-disabled, plugin-updated
Who cares fiber-admin, php, wordpress
4.0.1 or laterThe Fiber Admin WordPress plugin before 4.0.1 does not validate or escape a request header before writing it into a PHP file it regenerates on an unprotected admin hook, allowing unauthenticated attackers to execute arbitrary code when its custom database error page is enabled and they win a race against an administrator saving its settings.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.