CVE-2026-81344
Frontend Admin by DynamiApps <= 3.29.13 - Admin+ PHP Object Injection
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The ACF Frontend Admin by DynamiApps WordPress plugin through 3.29.13 does not restrict which PHP classes may be instantiated when it deserialises stored post content that is rendered on public-facing pages, allowing high-privilege users such as administrators to inject a PHP object which, given a suitable POP chain in another installed ACF Frontend Admin by DynamiApps WordPress plugin through 3.29.13 or in WordPress core, can be leveraged to achieve remote code execution.
| Vendor | unknown |
| Product | acf frontend admin by dynamiapps |
| Published | Oct 17, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown acf frontend admin by dynamiapps
Be the first to know when new unknown vulnerabilities affecting unknown acf frontend admin by dynamiapps are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / ACF Frontend Admin by DynamiApps
0 ≤ 3.29.13
References
Credits
Karthik Ramakrishnan WPScan