{"id":"CVE-2026-121491","kind":"vulnerability","aliases":["CVE-2026-121491"],"related":[],"title":"Fiber Admin WordPress plugin: unauthenticated request header writes executable PHP code","description":"The Fiber Admin WordPress plugin before 4.0.1 does not validate or escape a request header before writing it into a PHP file it regenerates on an unprotected admin hook, allowing unauthenticated attackers to execute arbitrary code when its custom database error page is enabled and they win a race against an administrator saving its settings.","summary":"The Fiber Admin WordPress plugin writes an unvalidated request header into a PHP file it regenerates, so the header content becomes code the server runs. An unauthenticated attacker can execute arbitrary code if the custom database error page is enabled and they win a race against an administrator saving the plugin settings.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["fiber-admin","package","php","wordpress"],"not_affected_if":["error-page-disabled","plugin-updated"],"how_to_check":"- Check the installed Fiber Admin plugin version in the WordPress admin plugins list, or in the plugin's main file header.\n- Check whether the custom database error page option is enabled in the plugin settings.\n- Look for recently regenerated PHP files written by the plugin in the WordPress directory.","fix":"- Fiber Admin WordPress plugin: move to `4.0.1` or later","status":"open","published_at":"2026-11-07T06:16:58+00:00","first_seen_at":"2026-11-07T06:46:04+00:00","triaged_at":"2026-11-07T06:48:22+00:00","updated_at":"2026-11-07T06:48:22+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-07T06:48:22Z","model":"claude-haiku-5-5","output":{"fix":"- Fiber Admin WordPress plugin: move to `4.0.1` or later","reach":"internet","title":"Fiber Admin WordPress plugin: unauthenticated request header writes executable PHP code","impact":"high","summary":"The Fiber Admin WordPress plugin writes an unvalidated request header into a PHP file it regenerates, so the header content becomes code the server runs. An unauthenticated attacker can execute arbitrary code if the custom database error page is enabled and they win a race against an administrator saving the plugin settings.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","php","fiber-admin"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Attacker runs arbitrary code on the WordPress server","analyst_note":"Confirm the exact affected version range and whether a patch or setting other than upgrading is available; the NVD entry gives only 'before 4.0.1'.","how_to_check":"- Check the installed Fiber Admin plugin version in the WordPress admin plugins list, or in the plugin's main file header.\n- Check whether the custom database error page option is enabled in the plugin settings.\n- Look for recently regenerated PHP files written by the plugin in the WordPress directory.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-updated","error-page-disabled"],"who_is_affected":"Sites running the Fiber Admin WordPress plugin before 4.0.1 with the custom database error page enabled are exposed. Sites without the plugin, on a fixed version, or with that error page disabled are not affected by the sources' description. The attack depends on a race with an administrator saving settings, which makes exploitation harder but still possible.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000742,"input_tokens":4227,"output_tokens":639,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-121491':14A,17A '-2026':13A,16A '4.0.1':82C 'admin':2A,20B,26B,78C,103C 'administr':71B,127C 'allow':105C 'arbitrari':54B,110C 'attack':51B,107C 'becom':44B 'code':11A,45B,55B,111C 'content':43B 'custom':58B,114C 'cve':12A,15A 'databas':59B,115C 'enabl':63B,119C 'error':60B,116C 'escap':87C 'execut':9A,53B,109C 'fiber':1A,19B,25B,77C 'fiber-admin':18B 'file':37B,97C 'header':7A,33B,42B,90C 'hook':104C 'packag':21B 'page':61B,117C 'php':10A,22B,36B,96C 'plugin':4A,28B,74B,80C 'race':68B,124C 'regener':39B,99C 'request':6A,32B,89C 'run':48B 'save':72B,128C 'server':47B 'set':75B,130C 'unauthent':5A,50B,106C 'unprotect':102C 'unvalid':31B 'valid':85C 'win':66B,122C 'wordpress':3A,23B,27B,79C 'write':8A,29B,92C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Fiber Admin WordPress plugin before 4.0.1 with the custom database error page enabled are exposed. Sites without the plugin, on a fixed version, or with that error page disabled are not affected by the sources' description. The attack depends on a race with an administrator saving settings, which makes exploitation harder but still possible.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["fiberadmin","high","package","php","wordpress"],"campaign_type":null,"search_a":"'-121491':14A,17A '-2026':13A,16A 'admin':2A 'code':11A 'cve':12A,15A 'execut':9A 'fiber':1A 'header':7A 'php':10A 'plugin':4A 'request':6A 'unauthent':5A 'wordpress':3A 'write':8A","search_b":"'admin':20B,26B 'administr':71B 'arbitrari':54B 'attack':51B 'becom':44B 'code':45B,55B 'content':43B 'custom':58B 'databas':59B 'enabl':63B 'error':60B 'execut':53B 'fiber':19B,25B 'fiber-admin':18B 'file':37B 'header':33B,42B 'packag':21B 'page':61B 'php':22B,36B 'plugin':28B,74B 'race':68B 'regener':39B 'request':32B 'run':48B 'save':72B 'server':47B 'set':75B 'unauthent':50B 'unvalid':31B 'win':66B 'wordpress':23B,27B 'write':29B","search_c":"'4.0.1':82C 'admin':78C,103C 'administr':127C 'allow':105C 'arbitrari':110C 'attack':107C 'code':111C 'custom':114C 'databas':115C 'enabl':119C 'error':116C 'escap':87C 'execut':109C 'fiber':77C 'file':97C 'header':90C 'hook':104C 'page':117C 'php':96C 'plugin':80C 'race':124C 'regener':99C 'request':89C 'save':128C 'set':130C 'unauthent':106C 'unprotect':102C 'valid':85C 'win':122C 'wordpress':79C 'write':92C","first_public_at":"2026-11-07T06:16:58+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121491","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121491","severity":null,"published_at":"2026-11-07T06:16:58+00:00","modified_at":"2026-11-07T06:16:58+00:00","first_seen_at":"2026-11-07T06:46:04+00:00","fetched_at":"2026-11-07T06:46:04+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}