---
id: "CVE-2026-121491"
page: "https://infrastack.ai/live/CVE-2026-121491"
kind: "vulnerability"
aliases: ["CVE-2026-121491"]
title: "Fiber Admin WordPress plugin: unauthenticated request header writes executable PHP code"
severity: "high"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["fiber-admin", "package", "php", "wordpress"]
not_affected_if: ["error-page-disabled", "plugin-updated"]
published_at: "2026-11-07T06:16:58+00:00"
first_seen_at: "2026-11-07T06:46:04+00:00"
updated_at: "2026-11-07T06:48:22+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121491", "first_seen_at": "2026-11-07T06:46:04+00:00"}]
exploit_sources: []
---

# Fiber Admin WordPress plugin: unauthenticated request header writes executable PHP code

Link for people: https://infrastack.ai/live/CVE-2026-121491 (this .md is for agents)

The Fiber Admin WordPress plugin writes an unvalidated request header into a PHP file it regenerates, so the header content becomes code the server runs. An unauthenticated attacker can execute arbitrary code if the custom database error page is enabled and they win a race against an administrator saving the plugin settings.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Fiber Admin plugin version in the WordPress admin plugins list, or in the plugin's main file header.
- Check whether the custom database error page option is enabled in the plugin settings.
- Look for recently regenerated PHP files written by the plugin in the WordPress directory.

## Fix

- Fiber Admin WordPress plugin: move to `4.0.1` or later

## Timeline

- 2026-11-07T06:46:04+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-121491

## From the sources

The Fiber Admin WordPress plugin before 4.0.1 does not validate or escape a request header before writing it into a PHP file it regenerates on an unprotected admin hook, allowing unauthenticated attackers to execute arbitrary code when its custom database error page is enabled and they win a race against an administrator saving its settings.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_