The Profile Builder Pro plugin for WordPress contains a PHP Object Injection vulnerability (CWE-502) due to unsafe deserialization of untrusted data. The vulnerability arises from the use of PHP's maybe_unserialize() function on the 'args' POST parameter within the wppb_request_users_pins_action_callback() AJAX handler. This handler is registered with both wp_ajax_ and wp_ajax_nopriv_ hooks, making it accessible to unauthenticated users. The lack of nonce verification, type checking, or input validation before deserialization allows attackers to inject arbitrary PHP objects into the application memory, potentially leading to full compromise. The CVSS 3.1 score is 8.1, reflecting high impact on confidentiality, integrity, and availability. No patch or official remediation is currently documented.

Successful exploitation allows unauthenticated attackers to inject arbitrary PHP objects into the application memory, which can lead to remote code execution, data compromise, and full system compromise. The vulnerability impacts confidentiality, integrity, and availability of the affected system. No known exploits in the wild have been reported at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected AJAX handler if possible, and monitor for suspicious activity related to the 'args' POST parameter. Avoid using vulnerable versions of Profile Builder Pro in exposed environments.