CVE-2026-121492

{
  "etk_id": "ETK-2026-3810",
  "cve_id": "CVE-2026-121492",
  "display_id": "CVE-2026-121492",
  "ghsa_id": "GHSA-cgwq-34w7-7rpv",
  "euvd_id": "EUVD-2026-118944",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Missing authorization in Fiber Admin AJAX actions",
  "summary": "Fiber Admin versions before 4.0.1 expose certain AJAX operations without authorization enforcement. An unauthenticated attacker can change the ordering of posts, drafts, private content, or navigation items; taxonomy-term ordering is also affected where that feature is enabled.",
  "mitigation": "Upgrade the Fiber Admin WordPress plugin to version 4.0.1 or later. Until updated, restrict access to the affected site's AJAX interface and disable term ordering where it is not required.",
  "vendor": null,
  "product": "Fiber Admin",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, < 4.0.1"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "4.0.1"
      ],
      "package_name": "Fiber Admin",
      "purl": null
    }
  ],
  "cwes": [
    862
  ],
  "cvss_score": 5.3,
  "cvss_src": "nvd",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "differential",
  "exploit": false,
  "pipeline_minutes": 22.4129846,
  "t0_at": "2026-11-07T06:00:27.064000+00:00",
  "signals": {
    "check": {
      "at": "2026-11-07T08:34:37.340014+00:00",
      "days": 0.10706337979166666,
      "is_lower_bound": false,
      "measured_at": "2026-11-07T06:00:27.064000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-11-07T06:00:27.064000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-11-07T06:00:27.064000+00:00",
      "url": "https://github.com/advisories/GHSA-cgwq-34w7-7rpv"
    }
  }
}