Profile Builder Pro CVE-2026-7647

Exploitation requires the Profile Builder Pro plugin version 3.14.5 or earlier installed and activated with the User Listing add-on enabled (the vulnerable one-map-listing.php file must be loaded). The AJAX handler wppb_request_users_pins must be registered via wp_ajax_nopriv_ hook, which occurs automatically when the add-on is active. Most critically, successful code execution depends on the presence of exploitable POP gadget chains-existing PHP classes in the WordPress core, active plugins, or themes that contain magic methods (__wakeup, __destruct, __toString, __call) capable of performing dangerous operations like file writes, SQL queries, or system command execution when instantiated through deserialization. Common gadget chain sources include file upload handlers, caching libraries, and database abstraction layers. The CVSS vector AV:N/AC:H/PR:N/UI:N confirms remote unauthenticated exploitation against default configurations of Profile Builder Pro, with AC:H (High Complexity) specifically reflecting the gadget chain dependency-the vulnerability is universally present but exploitation feasibility varies per environment.

The vulnerability presents significant risk with CVSS 8.1 (High), though the AC:H rating indicates exploitation is not trivial. The CVSS vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H shows remote unauthenticated exploitation capability with high impact across confidentiality, integrity, and availability. The High Attack Complexity stems from the need for attackers to identify or develop POP gadget chains specific to the target environment-exploitability depends on what other plugins and libraries are installed alongside Profile Builder Pro. However, PR:N (no privileges required) combined with network accessibility makes this a critical concern for public-facing WordPress sites. EPSS score and percentile data are not available for this CVE, limiting probability assessment. KEV status is not confirmed, suggesting no widespread active exploitation has been detected by CISA at time of analysis. The absence of nonce verification and type checking represents a complete failure of WordPress security best practices. Without POC confirmation data, actual exploit difficulty remains uncertain, though the Wordfence disclosure indicates the vulnerability is understood and reportable by security researchers. Real-world risk depends heavily on the target environment's plugin ecosystem and whether suitable gadget chains exist, but the unauthenticated remote attack vector makes this a priority for Profile Builder Pro users.

An unauthenticated remote attacker identifies a WordPress site running Profile Builder Pro 3.14.5 or earlier with the User Listing add-on enabled. The attacker analyzes the site's plugin ecosystem to identify available POP gadget chains-for example, a common plugin with a __destruct() method that writes to files or executes system commands. They craft a serialized PHP object chain exploiting these gadgets and send a POST request to /wp-admin/admin-ajax.php with action=wppb_request_users_pins and the malicious serialized payload in the args parameter. When the vulnerable AJAX handler deserializes the payload using maybe_unserialize(), the object chain triggers, allowing the attacker to write a web shell to the uploads directory, execute arbitrary PHP code as the web server user, exfiltrate database credentials from wp-config.php, or establish persistent backdoor access.