The vulnerability can be described as a PHP Object Injection where the plugin fails to restrict the classes that may be instantiated during deserialization of stored post content. This flaw allows administrators or high‑privilege users to inject a PHP object that, when combined with a compatible pop‑chain in another instance of the same plugin or in WordPress core, can lead to execution of arbitrary code. The impact is escalated for users with administrative rights, as they can cause site compromise with full control over the server environment. The flaw is confined to the processing of post content that is rendered on public‑facing pages, so the attack requires at least some administrative capability to inject malicious data.

This issue affects WordPress sites that have the ACF Frontend Admin by DynamiApps plugin installed, specifically versions 3.29.13 and earlier. Any site using these or older plugin releases is at risk when the plugin deserialises stored post content without sanitising the classes that may be instantiated.

The exploitability is high because the flaw leads to remote code execution once the attacker has the ability to inject a PHP object. The CVSS score of 6.6 indicates moderate severity, and the EPSS score of < 1% shows a low but non‑zero exploitation probability. The vulnerability is not yet listed in CISA KEV, indicating no known public exploits to date. The attack vector likely involves an administrator or privileged user creating or editing a post that contains a malicious serialized payload; when that content is rendered on a public page, the vulnerable deserialization occurs. Given the impact of remote code execution and the lack of immediate mitigation patches, the risk remains serious for any site still running affected versions of the plugin.