Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: Fiber Admin 4.0.1 Clear all filters
TI-2026-86426 CVE-2026-121492 · GHSA-cgwq-34w7-7rpv

Missing authorization in Fiber Admin lets attackers reorder posts

Priority LOW 29

The Fiber Admin WordPress plugin before 4.0.1 does not have authorisation checks in some of its AJAX actions, allowing unauthenticated users to change the order of arbitrary posts, including drafts, private posts and nav…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00221 Published 2026-11-07 Fixed in 4.0.1 CWE-862
TI-2026-86425 CVE-2026-121491 · GHSA-qr57-vj96-mp6j

Code injection in Fiber Admin WordPress plugin enables remote code execution

Priority MEDIUM 41

The Fiber Admin WordPress plugin before 4.0.1 does not validate or escape a request header before writing it into a PHP file it regenerates on an unprotected admin hook, allowing unauthenticated attackers to execute arbi…

CVSS 3.1CRITICAL 9.0 Network No auth No interaction EPSS 0.00395 Published 2026-11-07 Fixed in 4.0.1 CWE-94