8 matches found
CVE-2026-81344
The ACF Frontend Admin by DynamiApps WordPress plugin through 3.29.13 does not restrict which PHP classes may be instantiated when it deserialises stored post content that is rendered on public-facing pages, allowing high-privilege users such as administrators to inject a PHP object which, given ...
CVE-2026-81343
The ACF Frontend Admin by DynamiApps WordPress plugin through 3.29.13 does not perform a capability check on one of its form-submission actions before writing submitted values into the site's global ACF options store, allowing unauthenticated visitors to overwrite site-wide option values via a...
CVE-2026-81344 Frontend Admin by DynamiApps <= 3.29.13 - Admin+ PHP Object Injection
The ACF Frontend Admin by DynamiApps WordPress plugin through 3.29.13 does not restrict which PHP classes may be instantiated when it deserialises stored post content that is rendered on public-facing pages, allowing high-privilege users such as administrators to inject a PHP object which, given ...
CVE-2026-81343 Frontend Admin by DynamiApps <= 3.29.13 - Unauthenticated ACF Options Page Field Update via Form Submission
The ACF Frontend Admin by DynamiApps WordPress plugin through 3.29.13 does not perform a capability check on one of its form-submission actions before writing submitted values into the site's global ACF options store, allowing unauthenticated visitors to overwrite site-wide option values via a...
EUVD-2026-103259
The ACF Frontend Admin by DynamiApps WordPress plugin through 3.29.13 does not restrict which PHP classes may be instantiated when it deserialises stored post content that is rendered on public-facing pages, allowing high-privilege users such as administrators to inject a PHP object which, given ...
EUVD-2026-103258
The ACF Frontend Admin by DynamiApps WordPress plugin through 3.29.13 does not perform a capability check on one of its form-submission actions before writing submitted values into the site's global ACF options store, allowing unauthenticated visitors to overwrite site-wide option values via a...
CVE-2026-81343
The ACF Frontend Admin by DynamiApps WordPress plugin (versions through 3.29.13 ) contains a vulnerability where it fails to perform a capability check on a specific form-submission action. This flaw allows unauthenticated visitors to submit values via a public form that are subsequently written ...
CVE-2026-81344
The ACF Frontend Admin by DynamiApps WordPress plugin, version 3.29.13 and prior, is vulnerable to PHP Object Injection . The flaw occurs because the plugin fails to restrict which PHP classes can be instantiated during the deserialization of stored post content rendered on public-facing pages. T...