PT-2026-36582 · WordPress · Profile Builder
Mattia Brollo
·
Published
2026-05-02
·
Updated
2026-05-15
·
CVE-2026-7647
CVSS v3.1
8.1
High
| Vector | AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Profile Builder Pro versions prior to 3.14.6
Description
The Profile Builder Pro plugin for WordPress is susceptible to PHP Object Injection. This occurs because the
wppb request users pins action callback() AJAX handler uses the maybe unserialize() function on the args POST parameter without implementing nonce verification, type checking, or input validation. Since the handler is registered with both wp ajax and wp ajax nopriv hooks, unauthenticated attackers can inject arbitrary PHP objects into the application memory.Recommendations
Update the plugin to a version later than 3.14.5.
As a temporary workaround, restrict access to the
wppb request users pins action callback() function to minimize the risk of exploitation.Fix
Deserialization of Untrusted Data
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Profile Builder