PULSE
ESPT
FEED
ransommetaencryptor reclama a Christie Digital Systems · US · Technologyransommetaencryptor reclama a Daeah E&C · KR · Manufacturingransommetaencryptor reclama a DAEWON Chemical · KR · Manufacturingransommetaencryptor reclama a Wooshin Systems · KR · Technologyransommetaencryptor reclama a Proterial America, Ltd. · US · Manufacturingransommetaencryptor reclama a Hyundai E&C · KR · Manufacturingransommetaencryptor reclama a Pekin Insurance · US · Financial Servicesransomn0n reclama a Staples, Inc. / SBD Inc. · US · Retail & E-Commerceransomn0n reclama a Lampenwelt GmbH · DE · Retail & E-Commerceransomn0n reclama a Infutor Data Solutions · US · Technologyransomn0n reclama a Higginbotham · US · Professional Servicesransomrhysida reclama a Treuhand & Immobilien Abt AG · CH · Financial Servicesransomwhitearmor reclama a maersk · DK · Transportationransomqilin reclama a Acondistec · DE · Manufacturingransommetaencryptor reclama a Christie Digital Systems · US · Technologyransommetaencryptor reclama a Daeah E&C · KR · Manufacturingransommetaencryptor reclama a DAEWON Chemical · KR · Manufacturingransommetaencryptor reclama a Wooshin Systems · KR · Technologyransommetaencryptor reclama a Proterial America, Ltd. · US · Manufacturingransommetaencryptor reclama a Hyundai E&C · KR · Manufacturingransommetaencryptor reclama a Pekin Insurance · US · Financial Servicesransomn0n reclama a Staples, Inc. / SBD Inc. · US · Retail & E-Commerceransomn0n reclama a Lampenwelt GmbH · DE · Retail & E-Commerceransomn0n reclama a Infutor Data Solutions · US · Technologyransomn0n reclama a Higginbotham · US · Professional Servicesransomrhysida reclama a Treuhand & Immobilien Abt AG · CH · Financial Servicesransomwhitearmor reclama a maersk · DK · Transportationransomqilin reclama a Acondistec · DE · Manufacturing
← All CVEs
CVE WatchNov 7, 2026

CVE-2026-121492

The Fiber Admin WordPress plugin before 4.0.1 does not have authorisation checks in some of its AJAX actions, allowing unauthenticated users

CVSS

—

No CVSS

EPSS

—

KEV

—

Exploit Today

—

0-100

Published: Nov 7, 2026 · Last modified: Nov 7, 2026

EPSS · 30d

Not enough EPSS history yet.

Technical description

The Fiber Admin WordPress plugin before 4.0.1 does not have authorisation checks in some of its AJAX actions, allowing unauthenticated users to change the order of arbitrary posts, including drafts, private posts and navigation menu items, as well as the order of taxonomy terms when term ordering is enabled.

Official references
Related CVEs

No related CVEs by CWE or product.