home / blog
2026-11-07 · critical
CVE-2026-121491: Critical RCE in Fiber Admin plugin
Unauthenticated RCE in Fiber Admin plugin: update to 4.0.1 now.
CVE-2026-121491 is a critical vulnerability in the Fiber Admin plugin for WordPress. The flaw consists of failure to validate or escape an HTTP header before writing it to a PHP file regenerated on an unprotected admin hook. This allows unauthenticated users to execute arbitrary code if the custom database error page is enabled and they succeed in winning a race condition against an administrator saving the plugin settings.
The declared CVSS score is 9.0, placing the vulnerability in the critical category. The risk is maximal due to the absence of authentication requirements and the widespread deployment of the plugin in WordPress instances. The vulnerability was published on NVD on 2026-11-07; developers have already distributed version 4.0.1 with the fix. Discussions on X in recent days report the CVE with scores and technical details consistent with the official description.
WordPress administrators must immediately verify the presence of Fiber Admin on their servers. If detected, urgently update to version 4.0.1 or later from the WordPress control panel. As a temporary measure until updating, disable the custom database error page functionality. Also recommended: monitor access logs and administrative event records to detect exploitation attempts against the vulnerability before the patch is applied.
At a glance
- What
- The Fiber Admin plugin for WordPress, versions before 4.0.1, does not validate or escape an HTTP request header before writing it to a PHP file regenerated on an unprotected admin hook. It allows unauthenticated users to execute arbitrary code if the custom database error page is enabled and they win a race condition against an administrator saving settings.
- Severity
- CVSS 9.0 - Critical. Unauthenticated remote code execution: maximum risk for any WordPress installation.
- Affected versions
- Fiber Admin before version 4.0.1
- Fix
- Update the Fiber Admin plugin to version 4.0.1 or later via the WordPress control panel.
- Status
- Published on NVD on 2026-11-07. Fixed version 4.0.1 already available.
- Action
- 1) Verify Fiber Admin installation; 2) If present, update immediately to 4.0.1+; 3) If custom database error page is enabled, disable it until update; 4) Monitor access logs for exploitation attempts.
Sources: NVD, CVE-2026-121491