CVE-2026-76547 — PHP Object Injection in Profile Builder < 4.0.1

Researcher: Vivien Lebas Affected plugin: Profile Builder (WordPress) Affected versions: < 4.0.1 Fixed in: 4.0.1 Type: PHP Object Injection (Insecure Deserialization) CWE: CWE-502 OWASP: A8 – Insecure Deserialization CVSS 3.1: 6.6 (Medium) — AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H WPScan: Verified advisory

Summary

The Import/Export add-on of Profile Builder does not validate the type of data being deserialized when importing a configuration file. A high-privilege user (administrator) can therefore trigger PHP Object Injection by importing a crafted JSON file.

The add-on is a free extension, disabled by default, and Profile Builder itself ships no usable POP (Property-Oriented Programming) chain. Reaching a concrete impact therefore requires a suitable gadget from another installed plugin or theme.

Affected component

The vulnerability is in the import feature:

/wp-admin/admin.php?page=pbie-import-export&tab=import

A value inside the imported file is passed to WordPress's maybe_unserialize() without any type checking. If the value is a serialized object string, PHP instantiates the named class and runs its magic methods (__wakeup, __destruct) during the import request.

Prerequisites

• Profile Builder installed and active.
• The free Import and Export add-on enabled at Profile Builder > Add-ons (disabled on a stock install — an administrator must turn it on).
• An Administrator account (manage_options). On multisite, the import is gated on manage_network, so a Network/Super Administrator is required; a subsite Administrator is refused.
• A class with a usable magic method must be loaded on the target for the injected object to have an observable effect. Profile Builder ships none, so the payload below uses Evil as a stand-in for whatever such class an installed plugin or theme provides.

Proof of Concept

1. Log in as an Administrator and open:

   https://victim.example/wp-admin/admin.php?page=pbie-import-export&tab=import

2. Save the following as payload.json:

   {
     "options": {},
     "posts": {
       "wppb-rf-cpt": [
         {
           "post_title": "POC",
           "post_name": "poc",
           "post_type": "post",
           "post_status": "publish",
           "postmeta": {
             "poc": ["O:4:\"Evil\":0:{}"]
           }
         }
       ]
     }
   }

3. Choose payload.json in the JSON File field and press Import.

Result

The string inside the postmeta value is passed to maybe_unserialize(), so the named class is instantiated and its magic methods run during the import request.

Notes

• The outer key must be one of wppb-ul-cpt, wppb-rf-cpt or wppb-epf-cpt, but the post type actually created is taken from the per-post post_type field, so the path is reachable without a Pro licence.
• The deserialized object is not stored: the resulting meta row is empty. The impact is limited to what runs during that request.

Impact

PHP Object Injection. With a suitable gadget chain from another installed plugin or theme, this can lead to actions such as file operations or, depending on the available gadgets, remote code execution.

Remediation

Update Profile Builder to 4.0.1 or later.

Disclosure

This vulnerability was responsibly disclosed to the vendor and is published after a fix was made available, for educational and defensive purposes.