CVE-2026-121492: Fiber Admin < 4.0.1 - Unauthenticated Arbitrary Post and Term Order Modification via fiad_cpo_update and fiad_cpo_tax_update

Q: Which sites are exposed to this issue?

Sites using Fiber Admin versions earlier than 4.0.1 are affected. The issue can be exploited without authentication through the affected AJAX actions.

Q: What can an attacker change?

An attacker can modify the order of arbitrary posts, including draft posts, private posts, and navigation menu items. They can also change taxonomy-term order where term ordering is enabled.

Q: Are unpublished or non-public content items within scope?

Yes. Draft and private posts are explicitly included among the posts whose order can be changed.

Q: When does taxonomy-term ordering become affected?

Taxonomy terms are affected only when term ordering is enabled.

Published Nov 7, 2026

Updated

The Fiber Admin WordPress plugin before 4.0.1 does not have authorisation checks in some of its AJAX actions, allowing unauthenticated users to change the order of arbitrary posts, including drafts, private posts and navigation menu items, as well as the order of taxonomy terms when term ordering is enabled.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Fiber Admin to a version that resolves this vulnerability.
Fixed in 4.0.1

Event History

Nov 7, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Data Sourced

via NVD·06:16 AM

Description

Frequently Asked Questions

Which sites are exposed to this issue?

Sites using Fiber Admin versions earlier than 4.0.1 are affected. The issue can be exploited without authentication through the affected AJAX actions.

What can an attacker change?

An attacker can modify the order of arbitrary posts, including draft posts, private posts, and navigation menu items. They can also change taxonomy-term order where term ordering is enabled.

Are unpublished or non-public content items within scope?

Yes. Draft and private posts are explicitly included among the posts whose order can be changed.

When does taxonomy-term ordering become affected?

Taxonomy terms are affected only when term ordering is enabled.

CVE-2026-121492: Fiber Admin < 4.0.1 - Unauthenticated Arbitrary Post and Term Order Modification via fiad_cpo_update and fiad_cpo_tax_update

Remediation

Event History

Frequently Asked Questions

Which sites are exposed to this issue?

What can an attacker change?

Are unpublished or non-public content items within scope?

When does taxonomy-term ordering become affected?

Company

Resources

Contact

Frequently Asked Questions

Which sites are exposed to this issue?

What can an attacker change?

Are unpublished or non-public content items within scope?

When does taxonomy-term ordering become affected?