Fiber Admin WordPress Plugin Arbitrary Code Execution Vulnerability

The Fiber Admin WordPress plugin before 4.0.1 contains an arbitrary code execution vulnerability.

The plugin does not validate or escape a request header before writing it into a PHP file that it regenerates on an unprotected admin hook. This allows unauthenticated attackers to execute arbitrary code.

• Affected versions: before 4.0.1
• Precondition: the custom database error page must be enabled
• Exploitation requires winning a race against an administrator saving the plugin's settings