The vulnerability is a PHP Object Injection resulting from the uncontrolled deserialization of the 'post_content' field in admin_form posts. Because the plugin uses WordPress's maybe_unserialize() without class restrictions, an authenticated user with Editor-level permissions can craft a payload that results in a PHP object being instantiated. When combined with a PHP Object Poisoning chain, this allows execution of arbitrary code, effectively granting the attacker remote code execution privileges. This is a serious flaw identified as CWE‑502.

Affected systems are WordPress sites that have the Frontend Admin by DynamiApps plugin installed at any version up to and including 3.28.31. No specific hardware or OS platform is mentioned; the risk applies to every environment that hosts the vulnerable plugin, regardless of other configurations.

With a CVSS score of 7.2 the vulnerability presents a high potential for impact, but its exploitation requires an authenticated role of Editor or higher. The lack of an EPSS score and its absence from the KEV catalog suggest that we currently have no data on active exploitation but the possibility remains. Site administrators should treat this as a high risk and seek a remediation promptly. The attack vector is likely through the plugin’s admin interface, where an attacker can submit a crafted post_content value that triggers the vulnerable deserialization path.