CVE-2026-76547

Name of the Vulnerable Software and Affected Versions User Profile Builder WordPress plugin versions prior to 4.0.1

Description Insufficient validation of deserialized data occurs when importing a configuration file, which allows high privilege users, such as administrators, to perform PHP Object Injection. PHP Object Injection is a technique where an attacker leverages the way a programming language handles objects to execute unauthorized code or manipulate application logic. This issue resides in a free add-on that is disabled by default. Because no POP chain (a sequence of gadgets used to achieve code execution) exists within the plugin itself, exploitation requires a suitable gadget from another installed component.

Recommendations Update User Profile Builder WordPress plugin to version 4.0.1 or later. As a temporary mitigation, ensure the free add-on used for importing configuration files remains disabled.