Security Alert Summary
The Frontend Admin by DynamiApps WordPress plugin contains a PHP Object Injection vulnerability via deserialization of admin_form post content. Authenticated users with Editor-level access or higher can supply crafted data that is passed to WordPress’s maybe_unserialize() without class restrictions, enabling PHP object injection and, with a suitable POP chain, potential remote code execution.
CVE Details
- CVE ID: CVE-2026-3328
- Affected component: Frontend Admin by DynamiApps plugin (admin_form post content handling)
- Affected versions: All versions up to and including 3.28.31 (as stated in the description)
- Published: March 26, 2026, 4:17:11 AM
- Last modified: March 26, 2026, 4:17:11 AM
- CVSS v3.1: Base Score 7.2, Severity HIGH, Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- Authentication / Privileges / User interaction: Authentication required. Privileges required: High (attacker must be authenticated with Editor-level access or higher). User interaction: None.
- Primary impact: Confidentiality: High; Integrity: High; Availability: High
- Weakness: CWE-502 (Deserialization of Untrusted Data)
Technical Details
The vulnerability arises from use of WordPress’s maybe_unserialize() on user-controllable content stored in the post_content field of admin_form posts. Because there are no class restrictions applied before deserialization, an authenticated user with Editor-level access or higher can craft serialized PHP objects that get unserialized by the plugin.
The CVE description notes that the additional presence of a POP (property-oriented programming) chain allows an attacker to escalate the object injection into remote code execution (RCE). The issue is specifically tied to deserialization behavior and the lack of checks around classes or object types when handling admin_form post content.
How This Could Impact Your Website
Consider a site where a site owner manages content, editors or internal staff make changes, and external contributors or contractors can submit or edit certain forms. An attacker with Editor-level access could submit crafted form data that becomes stored in an admin_form post. When the plugin later unserializes that post_content, a PHP object provided by the attacker can be instantiated, potentially enabling actions consistent with the CVSS impacts.
- Confidentiality risk: attacker access could lead to access to sensitive data, including internal user information or email addresses stored on the site.
- Integrity risk: an attacker achieving code execution could modify site content, inject misleading information, or alter stored data.
- Availability risk: code execution could be used to disrupt site operation or deploy payloads that degrade performance or availability.
If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributors and Editors who do not need elevated privileges.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins and limit who can create or edit admin_form posts.
- Monitor site activity and logs for unusual behavior, including unexpected post content changes or new serialized data in admin_form posts.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
References
- https://plugins.trac.wordpress.org/browser/acf-frontend-form-element/tags/3.28.27/main/admin/admin-pages/forms/settings.php#L419
- https://plugins.trac.wordpress.org/browser/acf-frontend-form-element/trunk/main/admin/admin-pages/forms/settings.php#L419
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3486785%40acf-frontend-form-element&new=3486785%40acf-frontend-form-element&sfp_email=&sfph_mail=
- https://www.wordfence.com/threat-intel/vulnerabilities/id/0faa8f07-88c1-4638-9de5-e202807866e1?source=cve
