What is GHSA-cgwq-34w7-7rpv?

GHSA-cgwq-34w7-7rpv is a security advisory published by GitHub Security Advisories with Medium severity. The Fiber Admin WordPress plugin before 4.0.1 does not have authorisation checks in some of its...

Which CVE IDs does GHSA-cgwq-34w7-7rpv cover?

GHSA-cgwq-34w7-7rpv covers the following CVE IDs: CVE-2026-121492. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-cgwq-34w7-7rpv?

GHSA-cgwq-34w7-7rpv has a CVSS v3 base score of 5.3, published by GitHub Security Advisories.

GHSA-cgwq-34w7-7rpvMediumCVSS 5.3

The Fiber Admin WordPress plugin before 4.0.1 does not have authorisation checks in some of its...

Vendor

GitHub Security Advisories

Published

November 7, 2026

Last Modified

November 7, 2026

🔗 CVE IDs covered (1)

CVE-2026-121492 →

📋 Description

The Fiber Admin WordPress plugin before 4.0.1 does not have authorisation checks in some of its AJAX actions, allowing unauthenticated users to change the order of arbitrary posts, including drafts, private posts and navigation menu items, as well as the order of taxonomy terms when term ordering is enabled.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-121492
https://wpscan.com/vulnerability/d6ee9d6f-ab77-4bf3-98f5-b7c5899aa8bb
https://github.com/advisories/GHSA-cgwq-34w7-7rpv