The User Profile Builder WordPress plugin before 4.0.1 does not validate the type of data being deserialized when importing a configuration file,… (CVE-2026-76547)

The User Profile Builder WordPress plugin prior to version 4.0.1 improperly handles deserialization of imported configuration files by failing to validate the data type. This leads to a PHP Object Injection vulnerability exploitable by users with high privileges (e.g., administrators). The vulnerable functionality is part of a free add-on that is disabled by default. Since the plugin itself lacks a suitable POP (Property Oriented Programming) chain, successful exploitation depends on the presence of a gadget in another plugin or component installed alongside it.

Successful exploitation could allow a high privilege user to execute arbitrary PHP code via object injection, potentially leading to full compromise of the WordPress environment. However, the attack surface is limited because the vulnerable feature is disabled by default and exploitation requires additional gadgets from other plugins or components.

A fixed version 4.0.1 or later should be applied once available. Currently, no official patch or fix is confirmed. Users should disable the vulnerable add-on if it is enabled and monitor the vendor advisory for updates. Since the vulnerable feature is disabled by default, ensuring it remains disabled reduces risk. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.