What is the CVSS score of CVE-2026-7647?

CVE-2026-7647 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Profile Builder Pro are affected by CVE-2026-7647?

Profile Builder Pro for WordPress versions through 3.14.5 contain an unauthenticated remote code execution vulnerability via unsafe PHP object deserialization in an unprotected AJAX endpoint.

How to fix or mitigate CVE-2026-7647?

Within 24 hours: disable or remove Profile Builder Pro plugin; audit WordPress for unauthorized access and suspicious code. Within 7 days: implement Web Application Firewall (WAF) rules blocking requests to wppb_request_users_pins_action_callback endpoint if plugin cannot be removed; review server logs for exploitation attempts. Within 30 days: identify alternative WordPress user management solutions; deploy monitoring for PHP object deserialization attacks; establish patch-checking procedures for third-party plugins.

Profile Builder Pro CVE-2026-7647

EUVD-2026-26750 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-05-02 Wordfence

PHP WordPress Deserialization

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 02, 2026 - 06:32 vuln.today

EUVD ID Assigned

May 02, 2026 - 06:00 euvd

EUVD-2026-26750

Analysis Generated

May 02, 2026 - 06:00 vuln.today

CVE Published

May 02, 2026 - 05:29 nvd

HIGH 8.1

DescriptionCVE.org

The Profile Builder Pro plugin for WordPress is vulnerable to PHP Object Injection in all versions up to and including 3.14.5. This is due to the use of PHP's maybe_unserialize() function on the attacker-controlled 'args' POST parameter within the wppb_request_users_pins_action_callback() AJAX handler, which lacked any nonce verification, type checking, or input validation before deserialization. Because the handler was registered with both wp_ajax_ and wp_ajax_nopriv_ hooks, it was reachable by completely unauthenticated users. This makes it possible for unauthenticated attackers to inject arbitrary PHP objects into application memory.

AnalysisAI

Unauthenticated PHP object injection in Profile Builder Pro for WordPress allows remote attackers to execute arbitrary code by deserializing malicious objects through an unprotected AJAX endpoint. The vulnerability affects all versions through 3.14.5 and stems from unsafe deserialization of attacker-controlled POST data in the wppb_request_users_pins_action_callback() handler, which was registered for both authenticated and unauthenticated users without nonce verification. With CVSS 8.1 and AC:H complexity, exploitation requires chaining with a POP gadget chain, though EPSS data and KEV status are not available to confirm active exploitation.

Technical ContextAI

This vulnerability exploits WordPress's AJAX handler registration mechanism combined with PHP's object serialization features. The affected plugin registered the wppb_request_users_pins_action_callback() handler using both wp_ajax_wppb_request_users_pins and wp_ajax_nopriv_wppb_request_users_pins hooks in the one-map-listing.php file. The nopriv hook explicitly allows unauthenticated access, bypassing WordPress's standard authentication requirements. The handler passes the POST 'args' parameter directly to maybe_unserialize(), a WordPress wrapper for PHP's unserialize() function. CWE-502 (Deserialization of Untrusted Data) represents a well-known vulnerability class where attackers craft serialized PHP objects containing magic methods (__wakeup, __destruct, __toString) that trigger arbitrary code execution when deserialized. The AC:H (High Attack Complexity) in the CVSS vector reflects the requirement for attackers to identify suitable POP (Property-Oriented Programming) gadget chains within the WordPress installation-existing classes whose magic methods can be chained to achieve code execution, file manipulation, or SQL injection.

RemediationAI

Upgrade Profile Builder Pro to version 3.14.6 or later where Cozmoslabs has addressed the unsafe deserialization issue. The vendor-released patch should implement nonce verification for AJAX requests, add capability checks to restrict handler access to authenticated privileged users, validate and type-check the 'args' parameter before deserialization, or eliminate unsafe deserialization entirely by using JSON encoding instead of PHP serialization. If immediate patching is not feasible, implement a Web Application Firewall rule to block POST requests to /wp-admin/admin-ajax.php where action parameter equals 'wppb_request_users_pins' from unauthenticated sources-this prevents exploit delivery but may break legitimate plugin functionality if the map listing feature is used by site visitors. Alternatively, disable the User Listing add-on entirely if not required for site operations, though this represents significant feature loss. For sites requiring the map listing feature, restrict access via IP allowlisting or authentication at the web server level, accepting the trade-off of limiting public map accessibility. Monitor WordPress access logs for POST requests with suspicious serialized PHP objects in the 'args' parameter (look for patterns like 'O:' followed by class names). Review the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/c7b897f5-f988-4515-83bc-456f041d7e2e?source=cve for additional vendor guidance.