CVE-2026-121491

Summary

The Fiber Admin WordPress plugin before 4.0.1 writes unsanitized request header data into a PHP file via an unprotected admin hook, enabling unauthenticated remote code execution (RCE) when its custom database error page is enabled and an attacker successfully races an administrator's settings save operation.

Exploitability

Exploitation requires winning a race condition against an administrator saving plugin settings while the custom database error page is enabled, and the high attack complexity (AC:H) reflects the timing precision needed.

Blast radius

Successful exploitation grants full compromise of the WordPress site—including confidentiality, integrity, and availability—allowing attackers to steal data, deface the site, or pivot laterally.

Detection

Defenders should monitor for unexpected writes to plugin-generated PHP files (e.g., in wp-content/uploads/fiber-admin/) via file integrity monitoring, and correlate with unusual POST requests containing non-standard headers (e.g., X-Forwarded-For, User-Agent) targeting admin-ajax.php or admin-post.php endpoints during low-traffic periods. No reliable host or network indicator is derivable from the published description if such writes are not logged or monitored.

Prioritized remediation

Upgrade to Fiber Admin plugin version 4.0.1 or later, which patches the vulnerable header handling and adds proper validation/escaping before writing to PHP files.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.