Frontend Admin by DynamiApps < 3.30.0 – Admin+ PHP Object Injection | CVE 2026-81344

Description

The plugin does not restrict which PHP classes may be instantiated when it deserialises stored post content that is rendered on public-facing pages, allowing high-privilege users such as administrators to inject a PHP object which, given a suitable POP chain in another installed plugin or in WordPress core, can be leveraged to achieve remote code execution.

Proof of Concept

Prerequisites: a published Frontend Admin form placed on a public page. On current releases the attacker is an Administrator; in the 3.28.32 - 3.28.35 range an Editor suffices.

1. As the privileged user, open the form's post editor, take the post-edit nonce, and POST to /wp-admin/post.php with action=editpost, post_ID=<FORM_ID>, post_type=admin_form, post_status=publish, _wpnonce=<nonce>, and a raw serialized payload in the content parameter that embeds an object of a class carrying a magic method (__wakeup/__destruct), for example:

   content=a:3:{s:11:"who_can_see";s:3:"all";s:11:"show_button";i:1;s:4:"evil";O:16:"WPScan_POI_Probe":1:{s:4:"note";s:5:"pwned";}}

   Omit the plugin's own form parameter so its save handler returns early and the raw blob is stored unmodified.

2. As any unauthenticated visitor, GET the public page hosting the form. The stored blob is deserialised with no class restriction and the object is instantiated during that request.

With a POP gadget present in WordPress core, the bundled Freemius library, or another active plugin, this yields remote code execution or arbitrary file operations; with no gadget available it is object instantiation only.