{"id":"CVE-2026-121491","published":"2026-11-07T06:16:58.280","lastModified":"2026-11-10T16:28:46.510","description":"The Fiber Admin WordPress plugin before 4.0.1 does not validate or escape a request header before writing it into a PHP file it regenerates on an unprotected admin hook, allowing unauthenticated attackers to execute arbitrary code when its custom database error page is enabled and they win a race against an administrator saving its settings.","cvssScore":9,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-94"],"vendors":[],"products":[],"references":[{"url":"https://wpscan.com/vulnerability/42b9773d-9c69-4435-be20-ae86f52b4608/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The Fiber Admin WordPress plugin before 4.0.1 writes unsanitized request header data into a PHP file via an unprotected admin hook, enabling unauthenticated remote code execution (RCE) when its custom database error page is enabled and an attacker successfully races an administrator's settings save operation.","exploitability":"Exploitation requires winning a race condition against an administrator saving plugin settings while the custom database error page is enabled, and the high attack complexity (AC:H) reflects the timing precision needed.","blast_radius":"Successful exploitation grants full compromise of the WordPress site—including confidentiality, integrity, and availability—allowing attackers to steal data, deface the site, or pivot laterally.","remediation":"Upgrade to Fiber Admin plugin version 4.0.1 or later, which patches the vulnerable header handling and adds proper validation/escaping before writing to PHP files.","detection":"Defenders should monitor for unexpected writes to plugin-generated PHP files (e.g., in wp-content/uploads/fiber-admin/) via file integrity monitoring, and correlate with unusual POST requests containing non-standard headers (e.g., X-Forwarded-For, User-Agent) targeting admin-ajax.php or admin-post.php endpoints during low-traffic periods. No reliable host or network indicator is derivable from the published description if such writes are not logged or monitored.","tags":["rce","race-condition","unauthenticated","wordpress","plugin","cwe94"],"model":"garnet-coder","analyzedAt":"2026-11-08T09:48:18.008Z"}}