CVE-2026-7647: 
WordPress vulnerability analysis and mitigation

CVE-2026-7647 is a PHP Object Injection vulnerability in the Profile Builder Pro plugin for WordPress, affecting all versions up to and including 3.14.5. The flaw resides in the wppb_request_users_pins_action_callback() AJAX handler, which applies PHP's maybe_unserialize() to an attacker-controlled POST parameter without any nonce verification, type checking, or input validation. Because the handler is registered with both wp_ajax_ and wp_ajax_nopriv_ hooks, it is accessible to completely unauthenticated users. The vulnerability was published on May 2, 2026, and carries a CVSS v3.1 base score of 8.1 (High) (GitHub Advisory, Wordfence).

The root cause is classified as CWE-502 (Deserialization of Untrusted Data). The vulnerable code is located in add-ons/user-listing/one-map-listing.php (lines 13 and 271), where the args POST parameter is passed directly to maybe_unserialize() without sanitization, nonce verification, or type checking (GitHub Advisory). An unauthenticated attacker can send a crafted HTTP POST request to the WordPress AJAX endpoint (/wp-admin/admin-ajax.php) targeting the wppb_request_users_pins_action_callback action, supplying a serialized PHP object as the args parameter. Exploitation complexity is rated High because a suitable PHP gadget chain must exist within the WordPress installation or its plugins/themes to achieve meaningful post-injection impact (Wordfence).

Successful exploitation allows unauthenticated attackers to inject arbitrary PHP objects into application memory, which — when a suitable gadget chain is present — can lead to remote code execution, unauthorized data access, data manipulation, or service disruption. The confidentiality, integrity, and availability impacts are all rated High, meaning a fully compromised WordPress site could expose sensitive user data, allow content modification, or render the site unavailable. Lateral movement within a shared hosting environment is also a realistic risk if code execution is achieved (GitHub Advisory, Wordfence).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation (GitHub Advisory). The EPSS score is approximately 0.01–0.019%, indicating a low near-term exploitation probability. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (Wordfence).

1. Reconnaissance: Identify WordPress sites running Profile Builder Pro version ≤ 3.14.5 using tools like WPScan, Shodan, or by inspecting plugin metadata at /wp-content/plugins/profile-builder-pro/.
2. Identify the vulnerable endpoint: Confirm the AJAX action wppb_request_users_pins_action_callback is registered by checking plugin source or sending a probe POST request to /wp-admin/admin-ajax.php with action=wppb_request_users_pins_action_callback.
3. Craft a malicious serialized payload: Identify a usable PHP gadget chain within the target WordPress environment (e.g., from installed plugins or themes) using tools like PHPGGC. Serialize a malicious PHP object that triggers the desired action (e.g., file write, command execution) upon deserialization.
4. Deliver the payload: Send an unauthenticated HTTP POST request to /wp-admin/admin-ajax.php with the body action=wppb_request_users_pins_action_callback&args=<serialized_payload>. No authentication cookies or nonce tokens are required.
5. Trigger deserialization: The server calls maybe_unserialize() on the args parameter, instantiating the injected PHP object and invoking the gadget chain's magic methods (e.g., __destruct, __wakeup).
6. Achieve objective: Depending on the gadget chain, the attacker may achieve remote code execution, write a web shell, exfiltrate data, or escalate privileges within the WordPress environment (GitHub Advisory, Wordfence).

• Network: Unusual POST requests to /wp-admin/admin-ajax.php with action=wppb_request_users_pins_action_callback and a serialized PHP string (beginning with O:, a:, or s:) in the args parameter; outbound connections from the web server to unknown external IPs following such requests.
• Logs: Web server access logs showing repeated or anomalous POST requests to admin-ajax.php with large or encoded args values; PHP error logs containing deserialization warnings or unexpected object instantiation errors.
• File System: Newly created or modified PHP files in the WordPress installation directory (e.g., web shells in wp-content/uploads/ or plugin directories); unexpected changes to wp-config.php or .htaccess.
• Process: Unusual child processes spawned by the web server process (e.g., bash, curl, wget, python) that are not part of normal WordPress operation.

The primary remediation is to update the Profile Builder Pro plugin to a version beyond 3.14.5, which addresses the deserialization vulnerability (GitHub Advisory). As an interim measure, deploy Web Application Firewall (WAF) rules to detect and block serialized PHP object patterns in POST parameters targeting the admin-ajax.php endpoint. Additionally, consider restricting access to the AJAX endpoint at the network or server level if the user-listing/map feature is not required. Monitor server logs for suspicious POST requests to admin-ajax.php with the vulnerable action name (Wordfence).

Wordfence reported the vulnerability as part of their weekly WordPress vulnerability report covering April 27–May 3, 2026, and included it in their threat intelligence database (Wordfence Blog). The vulnerability was also referenced in a CISA vulnerability bulletin for the week of April 27, 2026 (CISA Bulletin). Community discussion was limited, with automated CVE tracking accounts on Mastodon and Bluesky noting the disclosure shortly after publication.