CVE-2026-121492 · Package
NO FIX YET · SEE WHAT TO DO
The Fiber Admin WordPress plugin before 4.0.1 has AJAX actions without authorisation checks. An unauthenticated visitor can change the order of posts, including drafts and private posts, navigation menu items, and taxonomy terms.
first public Nov 7, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Any WordPress site running the Fiber Admin plugin before 4.0.1 is exposed, because the flawed AJAX actions are reachable without logging in. Sites without this plugin, or with it at 4.0.1 or later, are not affected. The impact is limited to changing content order rather than reading or running code.
Not affected if plugin-not-installed, version-4.0.1-or-later
Who cares fiber-admin, self-hosted, wordpress
4.0.1 are affected.4.0.1 or later.The Fiber Admin WordPress plugin before 4.0.1 does not have authorisation checks in some of its AJAX actions, allowing unauthenticated users to change the order of arbitrary posts, including drafts, private posts and navigation menu items, as well as the order of taxonomy terms when term ordering is enabled.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.