CVE-2026-3328: Frontend Admin by DynamiApps <= 3.28.31 - Authenticated (Editor+) PHP Object Injection via 'post_content' of Admin Form Posts
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to PHP Object Injection via deserialization of the 'postcontent' of adminform posts in all versions up to, and including, 3.28.31. This is due to the use of WordPress's maybeunserialize() function without class restrictions on user-controllable content stored in adminform post content. This makes it possible for authenticated attackers, with Editor-level access and above, to inject a PHP Object. The additional presence of a POP chain allows attackers to achieve remote code execution.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-3328?
CVE-2026-3328 is a high severity vulnerability that allows for PHP Object Injection due to deserialization.
How do I fix CVE-2026-3328?
To fix CVE-2026-3328, update the Frontend Admin plugin by DynamiApps to a version beyond 3.28.31.
Who is affected by CVE-2026-3328?
Any user running Frontend Admin by DynamiApps plugin for WordPress version 3.28.31 and below is affected by CVE-2026-3328.
What kind of attack vector is presented by CVE-2026-3328?
CVE-2026-3328 presents an attack vector through authenticated users able to submit malicious 'post_content' in admin forms.
Is there any known exploit for CVE-2026-3328?
As of now, public exploits for CVE-2026-3328 are not widely documented, but the vulnerability itself allows for potential remote code execution.