{"id":"CVE-2026-104736","published":"2026-10-17T04:16:47.780","lastModified":"2026-10-17T04:16:47.780","description":"The LearnPress plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 4.4.10 via deserialization of untrusted input from the 'checkout-email' request parameter during the checkout AJAX action. The value is passed through sanitize_text_field(), which does not strip serialized object syntax, then stored in the LearnPress session table and later fed to LP_Helper::maybe_unserialize() → unserialize() (without an allowed_classes restriction) by LP_Session_Handler::get() on subsequent requests. This makes it possible for unauthenticated attackers to inject a PHP Object.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-502"],"vendors":[],"products":[],"references":[{"url":"https://plugins.trac.wordpress.org/browser/learnpress/tags/4.4.9.1/inc/class-lp-ajax.php#L21","tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/learnpress/tags/4.4.9.1/inc/class-lp-checkout.php#L377","tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/learnpress/tags/4.4.9.1/inc/class-lp-checkout.php#L523","tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/learnpress/tags/4.4.9.1/inc/class-lp-session-handler.php#L373","tags":[]},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=&old=3750024%40learnpress&new=3750024%40learnpress","tags":[]},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3e28e008-0ec1-4262-9ac0-6170cf8b8bdf?source=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The LearnPress WordPress plugin has a PHP Object Injection vulnerability that allows unauthenticated attackers to inject malicious PHP objects through the checkout-email parameter during checkout. This flaw can lead to remote code execution and complete system compromise.","exploitability":"Exploitation is relatively straightforward requiring only a single HTTP request to the checkout AJAX endpoint with a crafted serialized object payload, with no authentication or additional preconditions needed.","blast_radius":"If exploited, this vulnerability could allow attackers to execute arbitrary code on the WordPress server, potentially leading to full system compromise, data exfiltration, and persistent backdoor installation across all LearnPress installations up to version 4.4.10.","remediation":"Upgrade to LearnPress version 4.4.11 or later to remediate this vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","wp-plugin","php-injection"],"model":"garnet-coder","analyzedAt":"2026-10-17T08:47:42.090Z"}}