{"id":"CVE-2026-81344","published":"2026-10-17T06:16:33.830","lastModified":"2026-10-17T06:16:33.830","description":"The ACF Frontend Admin by DynamiApps WordPress plugin through 3.29.13 does not restrict which PHP classes may be instantiated when it deserialises stored post content that is rendered on public-facing pages, allowing high-privilege users such as administrators to inject a PHP object which, given a suitable POP chain in another installed ACF Frontend Admin by DynamiApps WordPress plugin through 3.29.13 or in WordPress core, can be leveraged to achieve remote code execution.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":[],"vendors":[],"products":[],"references":[{"url":"https://wpscan.com/vulnerability/4e6d6ade-d58c-40c1-9235-678dac0c0fa9/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}