UNKNOWN NVD

CVE-2026-121492

The Fiber Admin WordPress plugin before 4.0.1 does not have authorisation checks in some of its AJAX actions, allowing unauthenticated users to change the order

The Fiber Admin WordPress plugin before 4.0.1 does not have authorisation checks in some of its AJAX actions, allowing unauthenticated users to change the order of arbitrary posts, including drafts, private posts and navigation menu items, as well as the order of taxonomy terms when term ordering is enabled.

References

https://wpscan.com/vulnerability/d6ee9d6f-ab77-4bf3-98f5-b7c5899aa8bb/

Published: 2026-11-07 · Source: NVD · Feed updated: 2026-11-07

This unknown severity vulnerability was published on 2026-11-07 via NVD.

vulnfeed aggregates 16326 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.