What is the CVSS score of CVE-2026-3328?

CVE-2026-3328 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of PHP are affected by CVE-2026-3328?

A critical vulnerability in the Frontend Admin plugin allows authenticated users with editor-level access to execute arbitrary code on WordPress sites, potentially leading to complete system…

How to fix or mitigate CVE-2026-3328?

Within 24 hours: Audit all users with Editor role or above and disable unnecessary accounts; document current plugin version across all WordPress instances. Within 7 days: Either uninstall the Frontend Admin plugin entirely or implement WAF rules blocking admin_form post submissions; restrict editor role assignments to trusted personnel only. Within 30 days: Monitor vendor releases for security patches and establish a plan to migrate away from this plugin if no patch is released; implement code review processes for plugin selection.

PHP CVE-2026-3328

EUVD-2026-16086 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-03-26 Wordfence

GHSA-98q5-g3r5-8vrg

WordPress PHP RCE Deserialization

7.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 16:37 vuln.today

cvss_changed

EUVD ID Assigned

Mar 26, 2026 - 03:45 euvd

EUVD-2026-16086

Analysis Generated

Mar 26, 2026 - 03:45 vuln.today

CVE Published

Mar 26, 2026 - 02:25 nvd

HIGH 7.2

DescriptionCVE.org

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to PHP Object Injection via deserialization of the 'post_content' of admin_form posts in all versions up to, and including, 3.28.31. This is due to the use of WordPress's maybe_unserialize() function without class restrictions on user-controllable content stored in admin_form post content. This makes it possible for authenticated attackers, with Editor-level access and above, to inject a PHP Object. The additional presence of a POP chain allows attackers to achieve remote code execution.

AnalysisAI

The Frontend Admin by DynamiApps plugin for WordPress contains a PHP Object Injection vulnerability affecting all versions up to and including 3.28.31. Authenticated attackers with Editor-level privileges or higher can exploit unsafe deserialization of the 'post_content' field in admin_form posts to inject malicious PHP objects and achieve remote code execution through available POP chains. This represents a critical risk for WordPress sites using this plugin with elevated user accounts.

Technical ContextAI

This vulnerability stems from CWE-502 (Deserialization of Untrusted Data) where the plugin uses WordPress's maybe_unserialize() function on user-controllable content without implementing class restrictions or validation. The affected product per CPE is Frontend Admin by DynamiApps (cpe:2.3:a:shabti:frontend_admin_by_dynamiapps) where the admin_form post content is stored and later deserialized without proper sanitization. The code at settings.php line 419 performs this unsafe deserialization operation. PHP Object Injection vulnerabilities become exploitable when combined with Property-Oriented Programming (POP) chains present in the application or its dependencies, allowing attackers to trigger arbitrary code execution by crafting serialized objects that invoke existing class methods in unexpected sequences.

RemediationAI

Site administrators should immediately update the Frontend Admin by DynamiApps plugin to a version newer than 3.28.31 that addresses this deserialization vulnerability. The patch changeset can be reviewed at https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3486785%40acf-frontend-form-element&new=3486785%40acf-frontend-form-element&sfp_email=&sfph_mail= to verify the fix implementation. As an interim mitigation until patching is completed, administrators should audit and minimize the number of users with Editor-level or higher privileges, implement additional authentication controls for privileged accounts, and monitor admin_form post modifications for suspicious activity. Organizations should also review server logs for any indicators of exploitation attempts and consider temporarily disabling the plugin if it is not critical to operations until the update can be applied.