---
id: "CVE-2026-81344"
kind: "vulnerability"
aliases: ["CVE-2026-81344"]
title: "ACF Frontend Admin WordPress plugin: unrestricted PHP object deserialization enables code execution"
severity: "medium"
cvss: 6.6
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "self-hosted", "wordpress", "wordpress-plugins"]
not_affected_if: ["plugin-not-installed", "plugin-updated"]
published_at: "2026-10-17T06:16:33+00:00"
first_seen_at: "2026-10-23T21:57:14+00:00"
updated_at: "2026-10-25T03:47:02+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-81344", "first_seen_at": "2026-10-23T21:57:14+00:00"}]
---

# ACF Frontend Admin WordPress plugin: unrestricted PHP object deserialization enables code execution

The ACF Frontend Admin by DynamiApps WordPress plugin through 3.29.13 deserialises stored post content rendered on public pages without restricting which PHP classes it instantiates. An administrator can inject a PHP object that, combined with a suitable POP chain in this plugin or WordPress core, can lead to remote code execution.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of ACF Frontend Admin by DynamiApps in the WordPress plugins screen or `wp plugin get acf-frontend-display --field=version` (plugin slug unknown; verify in the sources)
- Look for the plugin version `3.29.13` or earlier
- unknown whether the sources name a specific file or setting to inspect

## Fix

- Update ACF Frontend Admin by DynamiApps to a version later than `3.29.13`; the fixed version is unknown from the sources
- Until patched, restrict Administrator accounts to trusted users only

## Timeline

- 2026-10-23T21:57:14+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-81344

## From the sources

The ACF Frontend Admin by DynamiApps WordPress plugin through 3.29.13 does not restrict which PHP classes may be instantiated when it deserialises stored post content that is rendered on public-facing pages, allowing high-privilege users such as administrators to inject a PHP object which, given a suitable POP chain in another installed ACF Frontend Admin by DynamiApps WordPress plugin through 3.29.13 or in WordPress core, can be leveraged to achieve remote code execution.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_