Description

The User Profile Builder WordPress plugin before 4.0.1 does not validate the type of data being deserialized when importing a configuration file, allowing high privilege users such as administrators to conduct PHP Object Injection. The affected feature is a free add-on which is disabled by default, and no POP chain is present in the User Profile Builder WordPress plugin before 4.0.1 itself, so further impact requires a suitable gadget from another installed User Profile Builder WordPress plugin before 4.0.1 or .

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.6",
  "pubDate": "2026-08-29T06:17:29.343Z",
  "pubdate": "2026-08-29T06:17:29.343Z",
  "executiveSummary": "The User Profile Builder WordPress plugin (prior to version 4.0.1) contains a critical security flaw involving insecure deserialization during configuration file imports.\nThe vulnerability is classified as PHP Object Injection, occurring because the plugin fails to perform adequate type validation on deserialized data.\nAlthough the vulnerability is restricted to a free add-on that is disabled by default, it poses significant security risks in environments where the feature is enabled.\nExploitation requires administrative or high-level privileges, as the import functionality is restricted to privileged users.\nThe impact depends on the availability of POP (Property Oriented Programming) chains within the WordPress environment; if a viable gadget chain exists in other installed plugins or the core system, an attacker could achieve remote code execution, file system manipulation, or unauthorized data access.\nThe lack of internal gadgets within the plugin itself necessitates a secondary, vulnerable component to achieve full impact.",
  "technicalDetails": "The root cause of this vulnerability lies in the use of the PHP 'unserialize()' function on user-supplied configuration data without implementing appropriate signature verification or whitelist-based type validation.\nWhen an administrator imports a configuration file through the affected add-on, the plugin processes the serialized string. If the input is maliciously crafted, the PHP engine instantiates arbitrary objects based on the classes present in the application's loaded scope.\nAttackers can leverage this behavior to perform PHP Object Injection. In a standard PHP environment, when an object is deserialized, the magic method '__wakeup()' or '__destruct()' is automatically invoked. These methods can be abused to execute unauthorized logic if the object's properties have been manipulated to influence existing code paths.\nThe attack flow proceeds as follows: First, the attacker identifies a configuration import interface provided by the add-on. Second, the attacker constructs a malicious serialized PHP object designed to interact with a specific 'gadget'—a class existing within the WordPress core or any installed third-party plugin that performs sensitive operations (such as file deletion or database queries) upon destruction or wake-up. Third, the attacker uploads the crafted configuration file via the plugin's import feature. Fourth, the server's 'unserialize()' function processes the payload, instantiating the attacker's object. Finally, if the object triggers a POP chain, the attacker achieves secondary impact, such as arbitrary code execution or privilege escalation.\nThis vulnerability is version-specific, affecting User Profile Builder versions prior to 4.0.1. Because the vulnerable component is an optional, disabled-by-default add-on, the attack surface is limited, but high-privilege users represent a target for social engineering or account takeover scenarios, which could then be used to trigger this vulnerability.\nSecurity impact remains contingent upon the presence of exploitable gadgets. Without a suitable POP chain present in the environment, the payload may result only in a denial-of-service (process crash) or fail silently, but the presence of other plugins significantly increases the probability of discovering an exploitable path."
}