CVE-2026-121491: Fiber Admin 3.1.0 - 4.0.0 - Unauthenticated RCE via Host Header

Published Nov 7, 2026

Updated

The Fiber Admin WordPress plugin before 4.0.1 does not validate or escape a request header before writing it into a PHP file it regenerates on an unprotected admin hook, allowing unauthenticated attackers to execute arbitrary code when its custom database error page is enabled and they win a race against an administrator saving its settings.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Fiber Admin WordPress plugin to a version that resolves this vulnerability.
Fixed in 4.0.1

Event History

Nov 7, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Data Sourced

via NVD·06:16 AM

Description

Frequently Asked Questions

What conditions must be present for exploitation to succeed?

The custom database error page must be enabled, and an unauthenticated attacker must win a race while an administrator saves the plugin's settings. The vulnerable request header is then written into a regenerated PHP file without validation or escaping.

Are sites using the plugin's default configuration necessarily exposed?

No. The described attack requires the plugin's custom database error page to be enabled; the provided information does not establish that this feature is enabled by default.

Which versions need remediation?

Fiber Admin versions before 4.0.1 are affected. Updating to 4.0.1 or later addresses the version range identified in the advisory.

What mitigation is available if the plugin cannot be updated immediately?

Disable the custom database error page, since it is a required condition for the described exploit. Administrators should also avoid saving the plugin's settings until the plugin can be updated, because exploitation depends on a race during that action.

CVE-2026-121491: Fiber Admin 3.1.0 - 4.0.0 - Unauthenticated RCE via Host Header

Remediation

Event History

Frequently Asked Questions

What conditions must be present for exploitation to succeed?

Are sites using the plugin's default configuration necessarily exposed?

Which versions need remediation?

What mitigation is available if the plugin cannot be updated immediately?

Company

Resources

Contact

Frequently Asked Questions

What conditions must be present for exploitation to succeed?

Are sites using the plugin's default configuration necessarily exposed?

Which versions need remediation?

What mitigation is available if the plugin cannot be updated immediately?