CVE-2026-121492 PUBLISHED

Fiber Admin < 4.0.1 - Unauthenticated Arbitrary Post and Term Order Modification via fiad_cpo_update and fiad_cpo_tax_update

Assigner: WPScan
Reserved: 03.11.2026 Published: 07.11.2026 Updated: 07.11.2026

The Fiber Admin WordPress plugin before 4.0.1 does not have authorisation checks in some of its AJAX actions, allowing unauthenticated users to change the order of arbitrary posts, including drafts, private posts and navigation menu items, as well as the order of taxonomy terms when term ordering is enabled.

Product Status

Vendor Unknown
Product Fiber Admin
Versions Default: unaffected
  • affected from 0 to 4.0.1 (excl.)

Credits

  • Enrico Marcolini finder
  • Claudio Marchesini finder
  • Dottor Marc finder
  • WPScan coordinator

References

Problem Types

  • CWE-862 Missing Authorization CWE