UNKNOWN NVD

CVE-2026-121491

The Fiber Admin WordPress plugin before 4.0.1 does not validate or escape a request header before writing it into a PHP file it regenerates on an unprotected ad

The Fiber Admin WordPress plugin before 4.0.1 does not validate or escape a request header before writing it into a PHP file it regenerates on an unprotected admin hook, allowing unauthenticated attackers to execute arbitrary code when its custom database error page is enabled and they win a race against an administrator saving its settings.

References

https://wpscan.com/vulnerability/42b9773d-9c69-4435-be20-ae86f52b4608/

Published: 2026-11-07 · Source: NVD · Feed updated: 2026-11-07

This unknown severity vulnerability was published on 2026-11-07 via NVD.

vulnfeed aggregates 16326 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.