CVE-2026-7647
Published: 02 May 2026
Summary
CVE-2026-7647 is a high-severity Deserialization of Untrusted Data (CWE-502) vulnerability in Wordpress (inferred from references). Its CVSS base score is 8.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 36.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-7647 is a PHP Object Injection vulnerability affecting the Profile Builder Pro plugin for WordPress in all versions up to and including 3.14.5. The issue stems from the use of PHP's maybe_unserialize() function on the attacker-controlled 'args' POST parameter within the wppb_request_users_pins_action_callback() AJAX handler, without any nonce verification, type checking, or input validation prior to deserialization. This handler is registered with both wp_ajax_ and wp_ajax_nopriv_ hooks, making it accessible without authentication.
Unauthenticated attackers can exploit this vulnerability remotely by sending a crafted POST request to the AJAX endpoint. Successful exploitation allows injection of arbitrary PHP objects into application memory, potentially leading to high confidentiality, integrity, and availability impacts, as reflected in the CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). The vulnerability is classified under CWE-502 (Deserialization of Untrusted Data).
Advisories and related resources, including the Wordfence threat intelligence page and WordPress plugin trac repositories, provide code-level details on the affected files such as add-ons/user-listing/one-map-listing.php. Practitioners should consult these references for verification and monitor for updates from the plugin vendor on patches or mitigations.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-26750
Vulnerability details
The Profile Builder Pro plugin for WordPress is vulnerable to PHP Object Injection in all versions up to and including 3.14.5. This is due to the use of PHP's maybe_unserialize() function on the attacker-controlled 'args' POST parameter within the wppb_request_users_pins_action_callback()…
more
AJAX handler, which lacked any nonce verification, type checking, or input validation before deserialization. Because the handler was registered with both wp_ajax_ and wp_ajax_nopriv_ hooks, it was reachable by completely unauthenticated users. This makes it possible for unauthenticated attackers to inject arbitrary PHP objects into application memory.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The unauthenticated remote PHP object injection via a public WordPress AJAX endpoint directly enables exploitation of a public-facing application.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Mandates validation, type checking, and input sanitization of the attacker-controlled 'args' POST parameter prior to deserialization, directly preventing PHP object injection via maybe_unserialize().
Requires identification, reporting, testing, and deployment of fixes for the specific deserialization flaw in Profile Builder Pro plugin versions up to 3.14.5.
Enforces approved access authorizations to block unauthenticated remote exploitation of the publicly accessible AJAX handler registered with wp_ajax_nopriv_ hooks.