Live › vulnerability › CVE-2026-81344
Go to dashboardThe ACF Frontend Admin by DynamiApps WordPress plugin through 3.29.13 deserialises stored post content rendered on public pages without restricting which PHP classes it instantiates. An administrator can inject a PHP object that, combined with a suitable POP chain in this plugin or WordPress core, can lead to remote code execution.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running ACF Frontend Admin by DynamiApps through 3.29.13 are affected, because the flaw sits in how the plugin reads stored post content shown on public pages. The exploit needs a high-privilege account such as an administrator to write the payload, and a suitable POP chain in this plugin or WordPress core to finish it. Sites without this plugin installed can skip it.
No product ranges from the sources yet.
wp plugin get acf-frontend-display --field=version (plugin slug unknown; verify in the sources)3.29.13 or earlier3.29.13; the fixed version is unknown from the sourcesEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The ACF Frontend Admin by DynamiApps WordPress plugin through 3.29.13 does not restrict which PHP classes may be instantiated when it deserialises stored post content that is rendered on public-facing pages, allowing high-privilege users such as administrators to inject a PHP object which, given a suitable POP chain in another installed ACF Frontend Admin by DynamiApps WordPress plugin through 3.29.13 or in WordPress core, can be leveraged to achieve remote code execution.
This page as .md · .json · in your agent: get_signal("CVE-2026-81344")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.