CVE-2026-104736
Received Received - Intake

PHP Object Injection in LearnPress WordPress Plugin

Publication date: 2026-10-17

Last updated on: 2026-10-17

Assigner: Wordfence

Description
The LearnPress plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 4.4.10 via deserialization of untrusted input from the 'checkout-email' request parameter during the checkout AJAX action. The value is passed through sanitize_text_field(), which does not strip serialized object syntax, then stored in the LearnPress session table and later fed to LP_Helper::maybe_unserialize() → unserialize() (without an allowed_classes restriction) by LP_Session_Handler::get() on subsequent requests. This makes it possible for unauthenticated attackers to inject a PHP Object.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-17
Last Modified
2026-10-17
Generated
2026-10-17
AI Q&A
2026-10-17
EPSS Evaluated
N/A
NVD
CVE-2026-104736
EUVD
EUVD-2026-103224

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
thimpress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-502 The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a PHP Object Injection vulnerability in the LearnPress WordPress plugin. It allows unauthenticated attackers to inject malicious PHP objects by exploiting improper deserialization of user input in the 'checkout-email' parameter during checkout. The input is stored and later unserialized without proper restrictions, enabling remote code execution.

Detection Guidance

To detect this vulnerability, inspect WordPress sites using LearnPress plugin versions up to 4.4.10. Check for unusual serialized data in the 'checkout-email' parameter during checkout AJAX actions. Review session tables for unexpected PHP objects. Use Wordfence or similar security plugins to scan for signs of PHP Object Injection attempts.

Impact Analysis

An attacker could exploit this to execute arbitrary PHP code on your server, potentially taking full control of your WordPress site. This could lead to data theft, site defacement, or being used as a pivot point for further attacks against your server or network.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating GDPR's data protection requirements and HIPAA's security rules for protected health information. Organizations may face fines, legal action, and reputational damage if exploited.

Mitigation Strategies

Immediately update the LearnPress plugin to the latest version. Disable the LearnPress plugin if an update is not available. Implement a web application firewall to block malicious requests. Review server logs for signs of exploitation attempts. Consider disabling AJAX checkout actions temporarily if vulnerable.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-104736. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart