PHP Object Injection Vulnerability in Profile Builder Pro Plugin for WordPress

CVE-2026-7647

What is CVE-2026-7647?

The Profile Builder Pro plugin for WordPress contains a significant vulnerability that allows unauthenticated users to exploit PHP Object Injection. This occurs due to the improper handling of the 'args' POST parameter in the wppb_request_users_pins_action_callback() AJAX handler, which utilizes the maybe_unserialize() function without adequate nonce verification, type checking, or input validation. As a result, an attacker can inject arbitrary PHP objects into the application's memory, creating severe security risks for affected WordPress installations.

References