Skip to content
OpenAdvisories
Medium · 6.6 Public exploit CVE-2026-76547 EUVD-2026-68051GHSA-w8mx-gm67-wrqq

Profile Builder < 4.0.1 - Admin+ PHP Object Injection via Import/Export

Published Aug 29, 2026 · Updated Aug 30, 2026 · Assigned by WPScan

Category: Web / CMS

Description

The User Profile Builder WordPress plugin before 4.0.1 does not validate the type of data being deserialized when importing a configuration file, allowing high privilege users such as administrators to conduct PHP Object Injection. The affected feature is a free add-on which is disabled by default, and no POP chain is present in the User Profile Builder WordPress plugin before 4.0.1 itself, so further impact requires a suitable gadget from another installed User Profile Builder WordPress plugin before 4.0.1 or .

Affected products

VendorProductAffectedFixed
— User Profile Builder 3.3.4 – < 4.0.1 4.0.1

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

References