Atomic Edge analysis of CVE-2026-7647 (metadata-based): This vulnerability allows unauthenticated PHP object injection in the Profile Builder Pro plugin for WordPress, versions 3.14.5 and earlier. The issue exists in an AJAX handler that unserializes user-supplied data without any authentication or validation checks. The CVSS score of 8.1 (HIGH) reflects the severe potential impact, though exploitation requires knowledge of available gadget chains.
The root cause, inferred from the CWE classification (Deserialization of Untrusted Data) and the description, is the unsafe use of PHP’s maybe_unserialize() function on the ‘args’ POST parameter in the wppb_request_users_pins_action_callback() AJAX handler. The handler was registered with both wp_ajax_ and wp_ajax_nopriv_ hooks, meaning it is accessible to unauthenticated users. No nonce verification, type checking, or input validation was performed before deserialization. This is a confirmed pattern from the CVE metadata, though the exact source code is not available for verification.
The attack vector is the WordPress AJAX endpoint wp-admin/admin-ajax.php with the action parameter set to wppb_request_users_pins. An unauthenticated attacker sends a POST request with the ‘args’ parameter containing a serialized PHP object payload. The attacker must first identify a suitable gadget chain within the WordPress core or any active plugins/themes that can perform dangerous operations when deserialized. The lack of nonce or authentication checks removes all barriers to exploitation. Attackers can deliver the exploit without any prior authentication.
The fix for this vulnerability, as applied in version 3.14.6, almost certainly involves replacing the unsafe maybe_unserialize() call with a safe alternative. The most common remediation is using json_decode() instead of unserializing arbitrary data, which does not trigger object instantiation. Additionally, the handler should implement nonce verification using wp_verify_nonce() and capability checks to restrict access to authenticated users with appropriate permissions. Input validation should also ensure the parameter is of an expected type before processing.
Successful exploitation allows an attacker to inject arbitrary PHP objects into the application’s memory. If a usable gadget chain exists (which is common in PHP applications), this can lead to remote code execution, SQL injection, file read/write operations, or privilege escalation. The attacker could completely compromise the WordPress site, extract sensitive data, install backdoors, or use the server for further attacks. The impact is total loss of confidentiality, integrity, and availability.
