What the vulnerability does
01Description
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to PHP Object Injection via deserialization of the 'post_content' of admin_form posts in all versions up to, and including, 3.28.31. This is due to the use of WordPress's `maybe_unserialize()` function without class restrictions on user-controllable content stored in admin_form post content. This makes it possible for authenticated attackers, with Editor-level access and above, to inject a PHP Object. The additional presence of a POP chain allows attackers to achieve remote code execution.
Explanation of Vulnerability in Simple Terms
02Summary
Frontend Admin by DynamiApps versions 3.28.31 and earlier contain a deserialization vulnerability in how they process untrusted data. An authenticated administrator can craft malicious serialized input to execute arbitrary code on the site. This requires high-level admin access but no user interaction. Sites running affected versions should update immediately.
What an attacker can do
03Attacker Capabilities
Run arbitrary code on the site with full admin privileges.
Potential impact on your site
04Site Impact
A compromised admin account can fully control your site, modify content, install backdoors, or steal data.
Conditions required to exploit
05Prerequisites
Attacker must have administrator-level access to the site.
Key dates
06Disclosure timeline
March 26, 2026
CVE published
April 8, 2026
Record updated
