{"id":"CVE-2026-121492","kind":"vulnerability","aliases":["CVE-2026-121492"],"related":[],"title":"Fiber Admin WordPress plugin lets anyone reorder posts and menus","description":"The Fiber Admin WordPress plugin before 4.0.1 does not have authorisation checks in some of its AJAX actions, allowing unauthenticated users to change the order of arbitrary posts, including drafts, private posts and navigation menu items, as well as the order of taxonomy terms when term ordering is enabled.","summary":"The Fiber Admin WordPress plugin before 4.0.1 has AJAX actions without authorisation checks. An unauthenticated visitor can change the order of posts, including drafts and private posts, navigation menu items, and taxonomy terms.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["fiber-admin","package","self-hosted","wordpress"],"not_affected_if":["plugin-not-installed","version-4.0.1-or-later"],"how_to_check":"- Check the installed version of the Fiber Admin plugin in the WordPress admin under Plugins; versions below `4.0.1` are affected.\n- Confirm the plugin is active on the site, since an inactive plugin does not run its AJAX handlers.","fix":"- Fiber Admin WordPress plugin: update to `4.0.1` or later.","status":"open","published_at":"2026-11-07T06:16:58+00:00","first_seen_at":"2026-11-07T06:46:04+00:00","triaged_at":"2026-11-07T06:48:22+00:00","updated_at":"2026-11-07T06:48:22+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-07T06:48:22Z","model":"claude-haiku-5-5","output":{"fix":"- Fiber Admin WordPress plugin: update to `4.0.1` or later.","reach":"internet","title":"Fiber Admin WordPress plugin lets anyone reorder posts and menus","impact":"low","summary":"The Fiber Admin WordPress plugin before 4.0.1 has AJAX actions without authorisation checks. An unauthenticated visitor can change the order of posts, including drafts and private posts, navigation menu items, and taxonomy terms.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","fiber-admin","self-hosted"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"unauthenticated users reorder drafts, private posts and menus","analyst_note":"","how_to_check":"- Check the installed version of the Fiber Admin plugin in the WordPress admin under Plugins; versions below `4.0.1` are affected.\n- Confirm the plugin is active on the site, since an inactive plugin does not run its AJAX handlers.","plain_action":"","needs_analyst":false,"not_affected_if":["plugin-not-installed","version-4.0.1-or-later"],"who_is_affected":"Any WordPress site running the Fiber Admin plugin before 4.0.1 is exposed, because the flawed AJAX actions are reachable without logging in. Sites without this plugin, or with it at 4.0.1 or later, are not affected. The impact is limited to changing content order rather than reading or running code.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000701,"input_tokens":4229,"output_tokens":557,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-121492':13A,16A '-2026':12A,15A '4.0.1':31B,64C 'action':34B,75C 'admin':2A,19B,27B,60C 'ajax':33B,74C 'allow':76C 'anyon':6A 'arbitrari':84C 'authoris':36B,68C 'chang':42B,80C 'check':37B,69C 'cve':11A,14A 'draft':48B,87C 'enabl':106C 'fiber':1A,18B,26B,59C 'fiber-admin':17B 'host':23B 'includ':47B,86C 'item':54B,93C 'let':5A 'menu':53B,92C 'menus':10A 'navig':52B,91C 'order':44B,82C,98C,104C 'packag':20B 'plugin':4A,29B,62C 'post':8A,46B,51B,85C,89C 'privat':50B,88C 'reorder':7A 'self':22B 'self-host':21B 'taxonomi':56B,100C 'term':57B,101C,103C 'unauthent':39B,77C 'user':78C 'visitor':40B 'well':95C 'without':35B 'wordpress':3A,24B,28B,61C","nicknames":[],"mitigations":[],"who_affected":"Any WordPress site running the Fiber Admin plugin before 4.0.1 is exposed, because the flawed AJAX actions are reachable without logging in. Sites without this plugin, or with it at 4.0.1 or later, are not affected. The impact is limited to changing content order rather than reading or running code.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["fiberadmin","medium","package","selfhosted","wordpress"],"campaign_type":null,"search_a":"'-121492':13A,16A '-2026':12A,15A 'admin':2A 'anyon':6A 'cve':11A,14A 'fiber':1A 'let':5A 'menus':10A 'plugin':4A 'post':8A 'reorder':7A 'wordpress':3A","search_b":"'4.0.1':31B 'action':34B 'admin':19B,27B 'ajax':33B 'authoris':36B 'chang':42B 'check':37B 'draft':48B 'fiber':18B,26B 'fiber-admin':17B 'host':23B 'includ':47B 'item':54B 'menu':53B 'navig':52B 'order':44B 'packag':20B 'plugin':29B 'post':46B,51B 'privat':50B 'self':22B 'self-host':21B 'taxonomi':56B 'term':57B 'unauthent':39B 'visitor':40B 'without':35B 'wordpress':24B,28B","search_c":"'4.0.1':64C 'action':75C 'admin':60C 'ajax':74C 'allow':76C 'arbitrari':84C 'authoris':68C 'chang':80C 'check':69C 'draft':87C 'enabl':106C 'fiber':59C 'includ':86C 'item':93C 'menu':92C 'navig':91C 'order':82C,98C,104C 'plugin':62C 'post':85C,89C 'privat':88C 'taxonomi':100C 'term':101C,103C 'unauthent':77C 'user':78C 'well':95C 'wordpress':61C","first_public_at":"2026-11-07T06:16:58+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121492","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121492","severity":null,"published_at":"2026-11-07T06:16:58+00:00","modified_at":"2026-11-07T06:16:58+00:00","first_seen_at":"2026-11-07T06:46:04+00:00","fetched_at":"2026-11-07T06:46:04+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}