CVE-2026-81344

Name of the Vulnerable Software and Affected Versions ACF Frontend Admin by DynamiApps versions prior to 3.29.14

Description The plugin fails to restrict the PHP classes that can be instantiated during the deserialization of stored post content rendered on public pages. This allows high-privilege users, such as administrators, to perform PHP Object Injection. If a suitable POP chain (a sequence of gadgets used to execute arbitrary code) exists within the plugin or WordPress core, this can lead to remote code execution.

Recommendations Update ACF Frontend Admin by DynamiApps to version 3.29.14 or later.