Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-11-10
Fiber Admin - Security Vulnerability (CVE-2026-121491)
The Fiber Admin WordPress plugin before 4.0.1 does not validate or escape a request header before writing it into a PHP file it regenerates on an unprotected admin hook, allowing unauthenticated attackers to execute arbitrary code when its custom database error page is enabled and they win a race against an administrator saving its settings.
PLUGIN
Fiber Admin
CVE-2026-121491
Risk Score
Threat Entry
Updated 2026-11-10
Fiber Admin - Security Vulnerability (CVE-2026-121492)
The Fiber Admin WordPress plugin before 4.0.1 does not have authorisation checks in some of its AJAX actions, allowing unauthenticated users to change the order of arbitrary posts, including drafts, private posts and navigation menu items, as well as the order of taxonomy terms when term ordering is enabled.
PLUGIN
Fiber Admin
CVE-2026-121492
Risk Score