CVE-2026-81344
CVE-2026-81344 · Frontend Admin by DynamiApps <= 3.29.13 - Admin+ PHP Object Injection
Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.
The ACF Frontend Admin by DynamiApps WordPress plugin through 3.29.13 does not restrict which PHP classes may be instantiated when it deserialises stored post content that is rendered on public-facing pages, allowing high-privilege users such as administrators to inject a PHP object which, given a suitable POP chain in another installed ACF Frontend Admin by DynamiApps WordPress plugin through 3.29.13 or in WordPress core, can be leveraged to achieve remote code execution.
CVSS 6.6 · Moyenne · EPSS 0,3%
- Publication
- Mise à jour
Produits et versions concernés
acf frontend admin by dynamiapps
- Versions du logiciel
- ≥ 0, ≤ 3.29.13: Concernée (semver)
Aucun correctif publié