Skip to content
Threat Feed

Tag

Php-Object-Injection

1 brief RSS
critical advisory

WordPress Profile Builder Pro Plugin PHP Object Injection Vulnerability (CVE-2026-7647)

An unauthenticated PHP Object Injection vulnerability exists in the Profile Builder Pro WordPress plugin (versions up to 3.14.5) due to the insecure use of `maybe_unserialize()` on the 'args' POST parameter in the `wppb_request_users_pins_action_callback()` AJAX handler, potentially leading to arbitrary code execution.

Profile Builder Pro plugin php-object-injection wordpress plugin rce
2r 1t 1c