{"id":"CVE-2026-81344","title":"Frontend Admin by DynamiApps <= 3.29.13 - Admin+ PHP Object Injection","summary":"The ACF Frontend Admin by DynamiApps WordPress plugin through 3.29.13 does not restrict which PHP classes may be instantiated when it deserialises stored post content that is rendered on public-facing pages, allowing high-privilege users…","severity":"none","cwe":["CWE-502"],"product":"ACF Frontend Admin by DynamiApps","affected":["acf_frontend_admin_by_dynamiapps <= 3.29.13"],"published":"2026-10-17","updated":"2026-10-17","sourceUpdated":"2026-10-17T06:00:14.995Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-81344","references":[{"url":"https://wpscan.com/vulnerability/4e6d6ade-d58c-40c1-9235-678dac0c0fa9/"}],"tags":["cve.org"],"ingestedAt":"2026-10-17T07:01:26.048Z","slug":"CVE-2026-81344","body":"## Overview\n\nThe ACF Frontend Admin by DynamiApps WordPress plugin through 3.29.13 does not restrict which PHP classes may be instantiated when it deserialises stored post content that is rendered on public-facing pages, allowing high-privilege users such as administrators to inject a PHP object which, given a suitable POP chain in another installed ACF Frontend Admin by DynamiApps WordPress plugin through 3.29.13 or in WordPress core, can be leveraged to achieve remote code execution.\n\n## Affected\n\n- `acf_frontend_admin_by_dynamiapps <= 3.29.13`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}