What’s Vulnerable › Vulnerabilities
CVE-2026-104736: LearnPress <= 4.4.10 - Unauthenticated PHP Object Injection via 'checkout-email' Parameter
- Severity: critical (CVSS 9.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 2.5% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2026-10-17 · updated 2026-10-19
- Weakness: CWE-502
Description
The LearnPress plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 4.4.10 via deserialization of untrusted input from the 'checkout-email' request parameter during the checkout AJAX action. The value is passed through sanitize_text_field(), which does not strip serialized object syntax, then stored in the LearnPress session table and later fed to LP_Helper::maybe_unserialize() → unserialize() (without an allowed_classes restriction) by LP_Session_Handler::get() on subsequent requests. This makes it possible for unauthenticated attackers to inject a PHP Object.
Affected products
References
- https://plugins.trac.wordpress.org/browser/learnpress/tags/4.4.9.1/inc/class-lp-ajax.php#L21
- https://plugins.trac.wordpress.org/browser/learnpress/tags/4.4.9.1/inc/class-lp-checkout.php#L377
- https://plugins.trac.wordpress.org/browser/learnpress/tags/4.4.9.1/inc/class-lp-checkout.php#L523
- https://plugins.trac.wordpress.org/browser/learnpress/tags/4.4.9.1/inc/class-lp-session-handler.php#L373
- https://plugins.trac.wordpress.org/changeset?reponame=&old=3750024%40learnpress&new=3750024%40learnpress
- https://www.wordfence.com/threat-intel/vulnerabilities/id/3e28e008-0ec1-4262-9ac0-6170cf8b8bdf?source=cve
Get alerted when CVE-2026-104736 or the next vulnerability affects your stack