Skip to content

CVE-2026-121491 Fiber Admin 3.1.0 - 4.0.0 - Unauthenticated RCE via Host Header

CriticalCVSS 9.0
Published
Updated
Exploit status
No public exploit known
Sign in for asset impact Search another CVE

Description

The Fiber Admin WordPress plugin before 4.0.1 does not validate or escape a request header before writing it into a PHP file it regenerates on an unprotected admin hook, allowing unauthenticated attackers to execute arbitrary code when its custom database error page is enabled and they win a race against an administrator saving its settings.

Affected products

No affected product data has been published yet.

References

  • wpscan.com exploit technical-description vdb-entry