Exploiting a PHP Object Injection in Profile Builder Pro in the era of AI

Original text by Mattia (0xbro) Brollo

The article analyzes a vulnerability in the WordPress plugin Profile Builder Pro that allows unauthenticated PHP Object Injection, demonstrating how modern AI-assisted reverse engineering and code analysis can help identify and exploit complex vulnerabilities faster. The research explains how a vulnerable AJAX endpoint in the plugin processes user-controlled input…

https://core-jmp.org/2026/03/exploiting-a-php-object-injection-in-profile-builder-pro-in-the-era-of-ai/