The Profile Builder Pro plugin for WordPress contains a PHP Object Injection vulnerability in all versions up to and including 3.14.5. This flaw arises from unsafe deserialization of the 'args' POST parameter in an AJAX handler that lacks nonce verification, type checking, and input validation. The vulnerable handler is accessible to unauthenticated users, allowing remote attackers to inject arbitrary PHP objects into application memory.