The vulnerability resides in the Profile Builder Pro WordPress plugin, where the wppb_request_users_pins_action_callback() AJAX handler processes the 'args' POST parameter using PHP's maybe_unserialize() function without any nonce verification, type checking, or input validation. This lack of defenses allows an attacker to supply a serialized object payload that, when deserialized, can result in arbitrary PHP code execution within the application. The flaw is a classic example of CWE-502, deserialization of untrusted data.

All installations of Cozmoslabs’ Profile Builder Pro plugin up to and including version 3.14.5 on WordPress are affected. Any WordPress site deploying these plugin versions without additional security hardening is susceptible to exploitation.

The CVSS score of 8.1 indicates a high severity problem. Although an EPSS score is not available, the vulnerability is reachable via unauthenticated AJAX requests, making it trivially exploitable by external actors. The flaw is not listed in CISA's KEV catalog, but the absence of authentication and the presence of object injection mean that remote code execution could be achieved with little to no effort once the target is known.