Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The Fiber Admin WordPress plugin before 4.0.1 does not validate or escape a request header before writing it into a PHP file it regenerates on an unprotected admin hook, allowing unauthenticated attackers to execute arbitrary code when its custom database error page is enabled and they win a race against an administrator saving its settings.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
🆕 New CVE Fiber Admin: remote code execution via host header (CVE-2026-121491) Unauthenticated attackers can run arbitrary code on affected WordPress sites by injecting a request header. Patch → 4.0.1 https://cve.now/CVE-2026-121491?utm_source=x&utm_medium=social&utm_campaign=cvedotnow&utm_content=critical
🔴 Fiber Admin: Fiber Admin 3.1.0 - 4.0.0 - Unauthenticated RCE via Host Header (CVE-2026-121491) Fix → 4.0.1 https://agentprime.io/advisories/CVE-2026-121491/
🆕 New CVE: CVE-2026-121491 (CVSS 9.0) Unknown Fiber Admin · Remote code execution Remote, no login needed. The Fiber Admin WordPress plugin before 4.0.1 does not validate or escape a request header before writing it into a PHP file it regenerates on… https://app.enclave.ai/threat-feed/CVE-2026-121491