Fiber Admin

Fiber Admin has 2 disclosed vulnerabilities in the WordSec catalog, all reported in 2026; all 2 are fixed as of November 2026. Their average CVSS score is 7.6, and the most serious one scores 9.8 out of 10. Severity breakdown: 1 critical and 0 high. 2026 was the busiest year with 2 disclosures.

The most common weakness is Improper Control Of Generation Of Code, behind 1 of the records (50%). Other recurring categories include Missing Authorization.

Every one of the 2 issues recorded for Fiber Admin has a vendor fix available, so running the current release closes all known holes.

2 independent researchers contributed these findings, one record each. Fiber Admin is installed on roughly 100 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.4.

Strategic Overview

Avg CVSSHigh

7.6/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all Fiber Admin vulnerabilities before they are exploited.

Highest severity on recordCVSS 9.8CVE-2026-121491

Fiber Admin 3.1.0 - 4.0.0 - Unauthenticated Remote Code Execution

Read the full analysis

Vulnerability Records

2 records


2026-11-05 00:00	Fiber Admin <= 4.0.0 - Missing Authorization Fiber Admin <= 4.0.0	`CVE-2026-121492`	5.3 Medium	Enrico Marcolini	Yes
2026-11-05 00:00	Fiber Admin 3.1.0 - 4.0.0 - Unauthenticated Remote Code Execution Fiber Admin 3.1.0 – 4.0.0	`CVE-2026-121491`	9.8 Critical	Naoki Kawahigashi	Yes

Showing 1–2 of 2 reports

Latestv4.0.1

Fiber Admin

Author

daomapsieucap

0.0(0)

0/100

Last Updated

2026-11-04 (7d ago)

Active Installs

100+

Downloads

8,306

Requires WP

5.2+

Requires PHP

7.4+

Tested up to

WP 7.1.4

Created

2021-08-25 (5y ago)

Use your Site Settings to white label WordPress automatically. Customize admin login page by multiple options. Set Image Metadata automatically after uploading. Convert plain email text into link automatically. Enable SVG support. Drag and drop post types / taxonomies order. Duplicate post types with single item or bulk action. Protect your site image by disable right click / drag image into html page (only for non-admin users). Protect your site content by disable these following keys: Ctrl / Cmd + S, Ctrl / Cmd + A, Ctrl / Cmd + C, Ctrl / Cmd + X, Ctrl / Cmd + Shift + I (only for non-admin users). Disable WordPress comments & WordPress Automatic Updates completely as default. Customize 503 Database Error page. Fork the plugin on GitHub.

View on WordPress.org