blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2026-81344

MEDIUM 6.6 CVSS 3.1
Published
October 17, 2026
Last modified
October 19, 2026
NVD status
Deferred
Reported by
contact@wpscan.com
Weakness
CWE-502
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Description

The ACF Frontend Admin by DynamiApps WordPress plugin through 3.29.13 does not restrict which PHP classes may be instantiated when it deserialises stored post content that is rendered on public-facing pages, allowing high-privilege users such as administrators to inject a PHP object which, given a suitable POP chain in another installed ACF Frontend Admin by DynamiApps WordPress plugin through 3.29.13 or in WordPress core, can be leveraged to achieve remote code execution.

Affected products and versions

  • Unknown ACF Frontend Admin by DynamiApps — Up to and including 3.29.13

References

  • wpscan.com https://wpscan.com/vulnerability/4e6d6ade-d58c-40c1-9235-678dac0c0fa9/
  • nvd.nist.gov Official NVD record