Answer in brief
CVE-2026-121492 records a Unknown severity vulnerability in Fiber Admin < 4.0.1 - Unauthenticated Arbitrary Post and Term Order Modification via fiad_cpo_update and fiad_cpo_tax_update. The current sources do not mark it as known exploited. The current feed maps Unknown/Fiber Admin (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Unknown/Fiber Admin (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Unknown/Fiber Admingeneric | >=0 <4.0.1 | 4.0.1 |
Published upstream
Nov 7, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Nov 7, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Nov 7, 2026
The Fiber Admin WordPress plugin before 4.0.1 does not have authorisation checks in some of its AJAX actions, allowing unauthenticated users to change the order of arbitrary posts, including drafts, private posts and navigation menu items, as well as the order of taxonomy terms when term ordering is enabled.
Quoted source text, attributed separately from HOL analysis.