---
id: "CVE-2026-121492"
page: "https://infrastack.ai/live/CVE-2026-121492"
kind: "vulnerability"
aliases: ["CVE-2026-121492"]
title: "Fiber Admin WordPress plugin lets anyone reorder posts and menus"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["fiber-admin", "package", "self-hosted", "wordpress"]
not_affected_if: ["plugin-not-installed", "version-4.0.1-or-later"]
published_at: "2026-11-07T06:16:58+00:00"
first_seen_at: "2026-11-07T06:46:04+00:00"
updated_at: "2026-11-07T06:48:22+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121492", "first_seen_at": "2026-11-07T06:46:04+00:00"}]
exploit_sources: []
---

# Fiber Admin WordPress plugin lets anyone reorder posts and menus

Link for people: https://infrastack.ai/live/CVE-2026-121492 (this .md is for agents)

The Fiber Admin WordPress plugin before 4.0.1 has AJAX actions without authorisation checks. An unauthenticated visitor can change the order of posts, including drafts and private posts, navigation menu items, and taxonomy terms.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of the Fiber Admin plugin in the WordPress admin under Plugins; versions below `4.0.1` are affected.
- Confirm the plugin is active on the site, since an inactive plugin does not run its AJAX handlers.

## Fix

- Fiber Admin WordPress plugin: update to `4.0.1` or later.

## Timeline

- 2026-11-07T06:46:04+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-121492

## From the sources

The Fiber Admin WordPress plugin before 4.0.1 does not have authorisation checks in some of its AJAX actions, allowing unauthenticated users to change the order of arbitrary posts, including drafts, private posts and navigation menu items, as well as the order of taxonomy terms when term ordering is enabled.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_