Preliminary research

Exploiting a PHP Object Injection in Profile Builder Pro in the era of AI

Mattia (0xbro) Brollo · Sicuranext Blog · 19 March 2026

AI-collected research leads through 2 October 2026, including bounded month-by-month reviews of selected social and community sources from March through September. Unranked, incomplete, not community-vetted, and subject to change.

Uses WordPress cross-plugin autoloading to make a previously unavailable Monolog gadget reachable from Profile Builder Pro's PHP object injection. The new FingersCrossedHandler-to-ProcessHandler POP chain converts the unauthenticated primitive into command execution.

Record

Researcher

Mattia (0xbro) Brollo

Published by

Sicuranext Blog

Date

19 March 2026

In the archive

• Collected in the 2026 preliminary research sweep

Tags

• wordpress
• php
• object-injection
• deserialization
• gadget-chain
• rce
• owasp-a08-2021

This page is the archive's own catalogue record. The research is the work of Mattia (0xbro) Brollo, first published at the original source. Preserved copies are kept so the citation survives its host.