External risk intelligence

Fiber Admin WordPress Plugin Arbitrary Code Execution.

CVE advisorySeverity: CRITICAL (CVSS 9.0)

CVE-2026-121491

This vulnerability affects a WordPress plugin, which is typically deployed as part of a public-facing web application. Since the vulnerable functionality resides within a plugin installed on web servers reachable via the internet, it presents a common and plausible attack surface for remote, unauthenticated interaction.

Code Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability involves a WordPress plugin that, under specific conditions and a race against time, could allow unauthorized code execution by attackers. The core issue lies in how the plugin handles a request header, potentially leading to arbitrary code being written to a file. While the conditions are specific, the severity is high, indicating a significant potential risk if exploited.

Plugin flaw allows unauthenticated code execution.
High severity threat to WordPress sites.
Confirm relevance and assess exposure risk.

Attack Path

How an attacker could exploit the issue

An attacker could target the Fiber Admin WordPress plugin by exploiting a flaw in how it handles a request header. This flaw allows them to write arbitrary code into a PHP file, potentially leading to code execution if specific conditions are met, such as the plugin's custom database error page being enabled and a race condition occurring as an administrator saves settings.

No authentication needed to access.
Race condition on admin settings save.
Arbitrary code execution risk.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow unauthenticated attackers to execute arbitrary code on a WordPress site. This may occur when the plugin's custom database error page is enabled and an attacker can win a race condition against an administrator saving settings, enabling them to write malicious code into a PHP file. The potential impact includes full system compromise and unauthorized data access.

Arbitrary code execution on the server.
Unauthenticated attackers exploit a race condition.
Complete site takeover is possible.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability in the Fiber Admin WordPress plugin likely falls under the purview of the application or platform team responsible for managing WordPress instances. Their first step should be to inventory all WordPress sites, identify those using the affected plugin, and assess exposure by confirming if the custom database error page is enabled and if the plugin's admin hook is accessible. Coordination with security teams for potential compensating controls or vendor management for a timely fix will be crucial.

Application owners should manage remediation.
Verify custom error page and admin hook exposure.
Plan remediation based on site criticality.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Fiber Admin WordPress plugin?

Fiber Admin is a WordPress plugin used by site administrators to manage and configure various settings for their websites. It provides utilities that often include custom error handling features. Because it integrates directly into the WordPress environment, it operates within the server context where your site files and database reside.

What is the vulnerability in CVE-2026-121491?

This vulnerability is classified as CWE-94, which is the improper control of generation of code. Essentially, the plugin fails to properly clean a specific request header before including it in a PHP file it generates. This mistake allows a malicious actor to inject their own PHP code, which the server then executes.

How does an attacker trigger this vulnerability?

An attacker needs the plugin's custom database error page feature to be active. They must also win a race condition, timing their malicious request to coincide precisely with an administrator saving the plugin settings. If the error page is disabled, or if the attacker cannot synchronize their request with that administrative action, this specific code injection path will not function.

Is my site at risk if I use Fiber Admin?

Halo Surface Signal notes that since this plugin is typically part of a public-facing web application, it is reachable via the internet. This increases the likelihood that a remote, unauthenticated attacker could attempt to interact with the vulnerable admin hook. You should prioritize assessing your site if it is exposed to the public.

When should I take action for CVE-2026-121491?

You should act immediately by identifying which of your WordPress sites currently run versions of Fiber Admin prior to 4.0.1. Verify if your configuration has the custom database error page enabled, as that is a key requirement for the flaw. Follow your standard process to update the plugin to a secure version as soon as it is available to close the vulnerability.

References

wpscan.com/vulnerability/42b9773d-9c69-4435-be20-ae86f52b4608/

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.