18 matches found
CVE-2026-81344
The ACF Frontend Admin by DynamiApps WordPress plugin through 3.29.13 does not restrict which PHP classes may be instantiated when it deserialises stored post content that is rendered on public-facing pages, allowing high-privilege users such as administrators to inject a PHP object which, given ...
CVE-2026-81343
The ACF Frontend Admin by DynamiApps WordPress plugin through 3.29.13 does not perform a capability check on one of its form-submission actions before writing submitted values into the site's global ACF options store, allowing unauthenticated visitors to overwrite site-wide option values via a...
EUVD-2026-103258
The ACF Frontend Admin by DynamiApps WordPress plugin through 3.29.13 does not perform a capability check on one of its form-submission actions before writing submitted values into the site's global ACF options store, allowing unauthenticated visitors to overwrite site-wide option values via a...
WordPress ACF Frontend Admin by DynamiApps plugin <= 3.29.13 - Admin+ PHP Object Injection vulnerability
Admin+ PHP Object Injection vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin Frontend Admin by DynamiApps versions = 3.29.13...
CVE-2026-81344
The ACF Frontend Admin by DynamiApps WordPress plugin, in versions up to and including 3.29.13 , is vulnerable to PHP Object Injection . The root cause is a lack of restriction on which PHP classes can be instantiated during the deserialization of stored post content rendered on public-facing pag...
CVE-2026-81344 Frontend Admin by DynamiApps <= 3.29.13 - Admin+ PHP Object Injection
The ACF Frontend Admin by DynamiApps WordPress plugin through 3.29.13 does not restrict which PHP classes may be instantiated when it deserialises stored post content that is rendered on public-facing pages, allowing high-privilege users such as administrators to inject a PHP object which, given ...
CVE-2026-81343 Frontend Admin by DynamiApps <= 3.29.13 - Unauthenticated ACF Options Page Field Update via Form Submission
The ACF Frontend Admin by DynamiApps WordPress plugin through 3.29.13 does not perform a capability check on one of its form-submission actions before writing submitted values into the site's global ACF options store, allowing unauthenticated visitors to overwrite site-wide option values via a...
EUVD-2026-103259
The ACF Frontend Admin by DynamiApps WordPress plugin through 3.29.13 does not restrict which PHP classes may be instantiated when it deserialises stored post content that is rendered on public-facing pages, allowing high-privilege users such as administrators to inject a PHP object which, given ...
CVE-2026-81343
The ACF Frontend Admin by DynamiApps WordPress plugin, in versions up to and including 3.29.13 , is vulnerable to an authorization bypass. The plugin fails to perform a capability check on specific form-submission actions, which allows unauthenticated visitors to submit values through a public fo...
CVE-2026-81343 Frontend Admin by DynamiApps <= 3.29.13 - Unauthenticated ACF Options Page Field Update via Form Submission
The ACF Frontend Admin by DynamiApps WordPress plugin through 3.29.13 does not perform a capability check on one of its form-submission actions before writing submitted values into the site's global ACF options store, allowing unauthenticated visitors to overwrite site-wide option values via a...
CVE-2026-81344 Frontend Admin by DynamiApps <= 3.29.13 - Admin+ PHP Object Injection
The ACF Frontend Admin by DynamiApps WordPress plugin through 3.29.13 does not restrict which PHP classes may be instantiated when it deserialises stored post content that is rendered on public-facing pages, allowing high-privilege users such as administrators to inject a PHP object which, given ...
PT-2026-116371
Name of the Vulnerable Software and Affected Versions ACF Frontend Admin by DynamiApps versions prior to 3.29.14 Description The plugin fails to perform a capability check on a form-submission action before writing submitted values into the global ACF options store. This allows unauthenticated...
CVE-2026-81343: Missing Authorization
The ACF Frontend Admin by DynamiApps WordPress plugin through 3.29.13 does not perform a capability check on one of its form-submission actions before writing submitted values into the site's global ACF options store, allowing unauthenticated visitors to overwrite site-wide option values via a...
CVE-2026-81344: Deserialization of Untrusted Data
The ACF Frontend Admin by DynamiApps WordPress plugin through 3.29.13 does not restrict which PHP classes may be instantiated when it deserialises stored post content that is rendered on public-facing pages, allowing high-privilege users such as administrators to inject a PHP object which, given ...
PT-2026-116372
Name of the Vulnerable Software and Affected Versions ACF Frontend Admin by DynamiApps versions prior to 3.29.14 Description The plugin fails to restrict the PHP classes that can be instantiated during the deserialization of stored post content rendered on public pages. This allows high-privilege...
WordPress ACF Frontend Admin by DynamiApps: Permissions, licensing, and access control issues
The WordPress ACF Frontend Admin by DynamiApps version 3.29.13 and earlier has vulnerabilities related to permission authorization and access control. These vulnerabilities stem from improper permission allocation, which may lead to unauthorized privilege escalation...
WordPress ACF Frontend Admin by DynamiApps: SQL Injection Vulnerability
WordPress ACF Frontend Admin by DynamiApps version 3.29.13 and earlier has an SQL injection vulnerability. This vulnerability can be exploited by attackers with administrator privileges, allowing them to execute SQL injections and potentially lead to the disclosure of sensitive database informati...
WordPress ACF Frontend Admin by DynamiApps: Cross-site Script Vulnerability
WordPress ACF Frontend Admin by DynamiApps version 3.28.36 and earlier has a cross-site scripting vulnerability. This vulnerability stems from the getdynamicvalues function’s text-level search and replacement operation on content, without proper HTML parsing. As a result, authenticated attackers...