Unrated severityNVD Advisory· Published Nov 7, 2026

CVE-2026-121491

Description

The Fiber Admin WordPress plugin before 4.0.1 does not validate or escape a request header before writing it into a PHP file it regenerates on an unprotected admin hook, allowing unauthenticated attackers to execute arbitrary code when its custom database error page is enabled and they win a race against an administrator saving its settings.

Affected products

WordPress/Fiber Adminllm-create
Range: <4.0.1

Patches

Vulnerability mechanics

References

wpscan.com/vulnerability/42b9773d-9c69-4435-be20-ae86f52b4608/nvd

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000