Frontend Admin by DynamiApps < 3.30.0 - Admin+ PHP Object Injection

Description

The plugin does not restrict which PHP classes may be instantiated when it deserialises stored post content that is rendered on public-facing pages, allowing high-privilege users such as administrators to inject a PHP object which, given a suitable POP chain in another installed plugin or in WordPress core, can be leveraged to achieve remote code execution.