The Profile Builder Pro plugin for WordPress is vulnerable to PHP Object Injection because it uses the maybe_unserialize() function on the 'args' POST parameter within the wppb_request_users_pins_action_callback() AJAX handler without any nonce verification, type checking, or input validation. This handler is registered with both wp_ajax_ and wp_ajax_nopriv_ hooks, making it accessible to unauthenticated users. As a result, attackers can inject arbitrary PHP objects into the application memory, potentially leading to full compromise. The vulnerability is tracked as CVE-2026-7647 with a CVSS 3.1 score of 8.1 (high severity). No official patch or remediation guidance is currently available from the vendor.

Successful exploitation allows unauthenticated attackers to perform PHP Object Injection, which can lead to remote code execution, complete compromise of the affected WordPress site, and full control over application memory. The CVSS score of 8.1 reflects high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, it is recommended to disable or restrict access to the vulnerable AJAX handler if possible, or remove the Profile Builder Pro plugin to prevent exploitation. Monitor vendor channels for updates and apply patches promptly once available.