PHP Object Injection in WordPress Profile Builder Plugin

The Profile Builder Pro plugin for WordPress is vulnerable to PHP Object Injection in all versions up to and including 3.14.5. This is due to the use of PHP's maybe_unserialize() function on the attacker-controlled 'args' POST parameter within the wppb_request_users_pins_action_callback() AJAX handler, which lacked any nonce verification, type checking, or input validation before deserialization. Because the handler was registered with both wp_ajax_ and wp_ajax_nopriv_ hooks, it was reachable by completely unauthenticated users. This makes it possible for unauthenticated attackers to inject arbitrary PHP objects into application memory.

Casky was already ahead

This CVE exploits attack patterns that Casky's 419matched skills have been training on — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2026-7647 is a critical PHP Object Injection vulnerability in the Profile Builder Pro WordPress plugin affecting all versions through 3.14.5. The vulnerability exists in the wppb_request_users_pins_action_callback() AJAX handler, which deserializes untrusted user input from the 'args' POST parameter using PHP's maybe_unserialize() function without proper nonce verification, type checking, or input validation. Because this handler is registered with both wp_ajax_ and wp_ajax_nopriv_ hooks, it is accessible to unauthenticated attackers. This flaw allows attackers to instantiate arbitrary PHP objects, potentially leading to remote code execution, data theft, or privilege escalation on any WordPress site running the vulnerable plugin version.

Casky's 419 mapped security skills enable detection of the attack chain behind this vulnerability across MITRE ATT&CK techniques TA0001 (Initial Access), TA0043 (Reconnaissance), and TA0002 (Execution). Practitioners using Casky would identify suspicious patterns including: (1) unauthenticated AJAX requests to wppb_request_users_pins_action_callback with serialized PHP objects in POST parameters, (2) deserialization of untrusted data triggering magic methods like __wakeup() or __destruct(), and (3) subsequent process execution or file system access indicative of gadget chain exploitation. Claude's extended reasoning capability correlates these indicators to surface the root cause—missing input validation on deserialization—and maps defensive controls to CWE-502 (Deserialization of Untrusted Data) and WordPress-specific hardening practices like nonce validation and capability checks.

419 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-7647.

analyzing-android-malware-with-apktool

malware analysis · medium

Run

analyzing-apt-group-with-mitre-navigator

threat intelligence · low

Run

analyzing-bootkit-and-rootkit-samples

malware analysis · medium

Run

MITRE ATT&CK Techniques

TA0001 TA0043 TA0002

Practise detecting this in the Casky Playground

Run Claude AI skills against real targets and see findings like those behind CVE-2026-7647 — before the next CVE drops.

Join the Playground Waitlist →

X Instagram LinkedIn