# CVE-2026-81344: ACF Frontend Admin PHP object injection in deserialization

Source: https://junglewise.ai/threats/cve-2026-81344-the-acf-frontend-admin-by-dynamiapps-wordpress-plugin-through-3  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-17. Updated: 2026-10-17  
License: CC BY 4.0 with a link back

CVE-2026-81344 · Severity: info · Published 2026-10-17

The ACF Frontend Admin plugin for WordPress improperly deserializes user-supplied data without validation, allowing administrators to inject malicious PHP objects. If a suitable exploitation chain exists in other installed plugins or WordPress core, an attacker with admin privileges could execute arbitrary code on the web server.

Vendors: [DynamiApps](https://junglewise.ai/threats/vendors/dynamiapps).

## Quick answers

**Is CVE-2026-81344 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-81344 being exploited in the wild.

**How severe is CVE-2026-81344?** Informational severity, published 17 October 2026.

**Which products and versions are affected?** DynamiApps ACF Frontend Admin through 3.29.13.

**Is there a fix for CVE-2026-81344?** Yes: fixed in 3.30.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-81344 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-81344?** Check whether you run DynamiApps ACF Frontend Admin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 3.30.0

## Technical details

The plugin deserializes stored post content without restricting which PHP classes may be instantiated, enabling an authenticated admin user to craft a malicious serialized object. When the post content is rendered on public pages, the injected object can trigger a PHP Object Deserialization vulnerability (CWE-502). Successful exploitation requires a suitable Property-Oriented Programming (POP) chain to exist in another installed plugin or WordPress core to achieve remote code execution.

## Affected products

- DynamiApps ACF Frontend Admin through 3.29.13

## Timeline

- 2026-10-15: disclosed
- 2026-10-17: advisory

## References

- [https://wpscan.com/vulnerability/4e6d6ade-d58c-40c1-9235-678dac0c0fa9/](https://wpscan.com/vulnerability/4e6d6ade-d58c-40c1-9235-678dac0c0fa9/)

## Related threats

- [ACF Frontend Admin by DynamiApps access control bypass](https://junglewise.ai/threats/cve-2026-81343-the-acf-frontend-admin-by-dynamiapps-wordpress-plugin-through-3)