The profile-builder plugin prior to 2.1.4 for WordPress has no access control for activating or deactivating addons via AJAX.
cozmoslabs profile builder