CVE-2026-81344: Frontend Admin by DynamiApps <= 3.29.13 - Admin+ PHP Object Injection

Q: Who can exploit this issue?

An attacker needs high-privilege WordPress access, such as an administrator account, to inject the malicious serialized object into stored post content. The vulnerable content must then be rendered on a public-facing page.

Q: Is remote code execution guaranteed after object injection?

No. Remote code execution depends on a suitable PHP object-oriented programming chain being available in another installed affected plugin or in WordPress core. The provided information does not identify a specific chain.

Q: How can I determine whether my site is affected?

Check whether ACF Frontend Admin by DynamiApps is installed and whether its version is 3.29.13 or earlier. Also assess whether untrusted or compromised high-privilege users could create or modify post content that is displayed publicly.

Published Oct 17, 2026

Updated

The ACF Frontend Admin by DynamiApps WordPress plugin through 3.29.13 does not restrict which PHP classes may be instantiated when it deserialises stored post content that is rendered on public-facing pages, allowing high-privilege users such as administrators to inject a PHP object which, given a suitable POP chain in another installed ACF Frontend Admin by DynamiApps WordPress plugin through 3.29.13 or in WordPress core, can be leveraged to achieve remote code execution.

Affected Software

0 affected components

Event History

Oct 17, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Who can exploit this issue?

An attacker needs high-privilege WordPress access, such as an administrator account, to inject the malicious serialized object into stored post content. The vulnerable content must then be rendered on a public-facing page.

Is remote code execution guaranteed after object injection?

No. Remote code execution depends on a suitable PHP object-oriented programming chain being available in another installed affected plugin or in WordPress core. The provided information does not identify a specific chain.

How can I determine whether my site is affected?

Check whether ACF Frontend Admin by DynamiApps is installed and whether its version is 3.29.13 or earlier. Also assess whether untrusted or compromised high-privilege users could create or modify post content that is displayed publicly.

CVE-2026-81344: Frontend Admin by DynamiApps <= 3.29.13 - Admin+ PHP Object Injection

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

Is remote code execution guaranteed after object injection?

How can I determine whether my site is affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Is remote code execution guaranteed after object injection?

How can I determine whether my site is affected?