An unauthenticated PHP Object Injection vulnerability in the Cozmoslabs Profile Builder Pro plugin for WordPress allows remote attackers to inject arbitrary objects into application memory.

The software suffers from a Deserialization of Untrusted Data vulnerability, categorized under CWE-502. The attacker utilizes the unauthenticated wppb_request_users_pins_action_callback AJAX handler to pass untrusted input into PHP's maybe_unserialize function.

A successful exploit could lead to total system compromise, including unauthorized data access, data modification, or denial of service. With a CVSS score of 8.1, the high severity rating reflects the potential for complete confidentiality, integrity, and availability impact, threatening critical business operations and sensitive user data.

Immediate Action: Update the Cozmoslabs Profile Builder Pro plugin to the latest patched version once available from the vendor. If a patch is not yet available, temporarily deactivate the plugin to mitigate risk.

Proactive Monitoring: Monitor server access logs and database query times for anomalous traffic patterns targeting the wppb_request_users_pins_action_callback AJAX endpoint.

Compensating Controls: Deploy a Web Application Firewall rule to inspect POST requests and block traffic containing serialized PHP objects directed at vulnerable plugin endpoints.

Public Exploit Available: No

This high severity vulnerability presents a significant risk due to the lack of required authentication for exploitation. Administrators must apply the vendor patch immediately upon release or remove the plugin to prevent potential remote code execution or system compromise.