PHP Object Injection Vulnerability in ACF Frontend Admin Plugin by DynamiApps
CVE-2026-81344
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 17 October 2026
Badges
What is CVE-2026-81344?
The ACF Frontend Admin plugin by DynamiApps prior to version 3.29.13 allows for PHP object injection due to inadequate restrictions on PHP class instantiation during the deserialization of stored post content. This vulnerability facilitates high-privilege users, like administrators, to inject malicious PHP objects. If coupled with an appropriate Property-Oriented Programming (POP) chain, either within another instance of the ACF Frontend Admin plugin or within the WordPress core itself, this flaw can be exploited, leading to the potential for remote code execution on the affected system.
Affected Version(s)
ACF Frontend Admin by DynamiApps 0 <= 3.29.13
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.