Executive brief
User Profile Builder is a popular WordPress plugin for creating custom user registration and profile forms. The plugin's import/export add-on (disabled by default) fails to validate data during configuration file imports, allowing administrators to inject malicious PHP objects. This can lead to arbitrary code execution if other vulnerable plugins are installed, potentially compromising the entire website.
Technical details
The vulnerability is a PHP Object Injection (CWE-502) in the import/export add-on. When importing a configuration file, the plugin passes user-controlled data to maybe_unserialize() without type validation, allowing deserialization of arbitrary objects. Attack prerequisites include: the add-on must be explicitly enabled (disabled by default), attacker must hold administrator privileges (or network administrator on multisite), and a POP chain gadget must exist in another installed plugin or theme. The injected object's magic methods (__wakeup/__destruct) execute during the import request. Profile Builder itself contains no exploitable POP chain, limiting impact to gadgets from third-party plugins. The fix is available in version 4.0.1 and later.
Affected products
- Cozmoslabs Profile Builder before 4.0.1
Timeline
- 2026-08-27: disclosed
- 2026-08-29: patched