CVE-2026-104736
9.8 CRITICALPublished 2026-10-17 · Updated 2026-10-17
AI risk analysis
- Summary
- The LearnPress WordPress plugin has a PHP Object Injection vulnerability that allows unauthenticated attackers to inject malicious PHP objects through the checkout-email parameter during checkout. This flaw can lead to remote code execution and complete system compromise.
- Exploitability
- Exploitation is relatively straightforward requiring only a single HTTP request to the checkout AJAX endpoint with a crafted serialized object payload, with no authentication or additional preconditions needed.
- Blast radius
- If exploited, this vulnerability could allow attackers to execute arbitrary code on the WordPress server, potentially leading to full system compromise, data exfiltration, and persistent backdoor installation across all LearnPress installations up to version 4.4.10.
- Detection
- No reliable host or network indicator is derivable from the published description.
- Prioritized remediation
- Upgrade to LearnPress version 4.4.11 or later to remediate this vulnerability.
Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.
NVD description
The LearnPress plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 4.4.10 via deserialization of untrusted input from the 'checkout-email' request parameter during the checkout AJAX action. The value is passed through sanitize_text_field(), which does not strip serialized object syntax, then stored in the LearnPress session table and later fed to LP_Helper::maybe_unserialize() → unserialize() (without an allowed_classes restriction) by LP_Session_Handler::get() on subsequent requests. This makes it possible for unauthenticated attackers to inject a PHP Object.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-502
All references
- https://plugins.trac.wordpress.org/browser/learnpress/tags/4.4.9.1/inc/class-lp-ajax.php#L21
- https://plugins.trac.wordpress.org/browser/learnpress/tags/4.4.9.1/inc/class-lp-checkout.php#L377
- https://plugins.trac.wordpress.org/browser/learnpress/tags/4.4.9.1/inc/class-lp-checkout.php#L523
- https://plugins.trac.wordpress.org/browser/learnpress/tags/4.4.9.1/inc/class-lp-session-handler.php#L373
- https://plugins.trac.wordpress.org/changeset?reponame=&old=3750024%40learnpress&new=3750024%40learnpress
- https://www.wordfence.com/threat-intel/vulnerabilities/id/3e28e008-0ec1-4262-9ac0-6170cf8b8bdf?source=cve
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- CRITICALCVE-2026-42718
- HIGHCVE-2026-62021
- CRITICALCVE-2026-62046
- CRITICALCVE-2026-62077
- CRITICALCVE-2026-62120
- CRITICALCVE-2026-62124
- CRITICALCVE-2026-66482
- CRITICALCVE-2026-66483
Related by shared AI tags and CWE weakness class. Browse the full archive.