CVE-2026-76547: CWE-502 Deserialization of Untrusted Data in User Profile Builder

CVE-2026-76547 is a deserialization of untrusted data vulnerability (CWE-502) in the User Profile Builder WordPress plugin before version 4.0.1. The vulnerability arises from improper validation of data types during the import of configuration files in a free add-on feature, which is disabled by default. This allows users with high privileges (e.g., administrators) to conduct PHP Object Injection attacks. However, the plugin itself lacks a PHP Object Injection gadget chain, so exploitation requires a suitable gadget from another installed plugin or component. The vulnerability has a CVSS 3.1 base score of 6.6, indicating medium severity. No patch or official remediation is currently documented.

Successful exploitation could allow high privilege users to execute arbitrary PHP code via object injection, potentially leading to full compromise of the WordPress environment. However, since the vulnerable feature is disabled by default and no gadget chain is present within the plugin itself, exploitation complexity is higher and depends on the presence of other vulnerable components. The impact includes confidentiality, integrity, and availability loss as indicated by the CVSS vector.

No official patch or remediation guidance is currently available. Since the vulnerable feature is a free add-on disabled by default, ensure it remains disabled if not in use. Monitor vendor advisories for updates or patches addressing this vulnerability. Avoid importing configuration files from untrusted sources. Review installed plugins for potential gadget chains that could be leveraged in conjunction with this vulnerability.