WordPress Profile Builder Pro: Unauthenticated PHP Object Injection Risks Site Takeover

The National Vulnerability Database has disclosed CVE-2026-7647, a critical PHP Object Injection vulnerability impacting all versions of the Profile Builder Pro plugin for WordPress up to and including 3.14.5. This flaw stems from the wppb_request_users_pins_action_callback() AJAX handler, which improperly uses PHP’s maybe_unserialize() function on attacker-controlled input within the ‘args’ POST parameter. Crucially, this handler lacks any nonce verification, type checking, or input validation.

Because the vulnerable AJAX handler is registered with both wp_ajax_ and wp_ajax_nopriv_ hooks, it is accessible to completely unauthenticated users. This design oversight allows an attacker to inject arbitrary PHP objects into the application’s memory, setting the stage for remote code execution (RCE) and full site compromise. The National Vulnerability Database assigns this a CVSS score of 8.1 (HIGH), underscoring the severe risk.

This isn’t just a theoretical vulnerability; PHP Object Injection is a well-understood vector for RCE. Attackers can leverage this to upload malicious files, create new administrative users, or completely deface a site. The lack of authentication required makes exploitation trivial for anyone with basic knowledge of the vulnerability class. Defenders need to prioritize patching or removal immediately.