LearnPress WordPress plugin: Unauthenticated PHP Object Injection in checkout
Summary
LearnPress up to and including 4.4.10 deserializes untrusted input from the checkout-email parameter of the checkout AJAX action. An unauthenticated attacker can inject a PHP object that is unserialized later by the session handler. Depending on available gadget chains in the installed plugins and libraries, this can lead to code execution. A public proof-of-concept exists.
Affected
- LearnPress (WordPress plugin) versions up to and including 4.4.10
- Unknown whether all earlier versions are affected in the same way beyond the stated range
Fixed in
- Version 4.4.11 (from third-party sources; not yet confirmed against the vendor changelog)
Workaround
- No vendor-issued workaround known.
- If updating is delayed, restrict or temporarily disable guest checkout.
- Block requests to lp-ajax=checkout containing serialized PHP payloads at the WAF or reverse proxy.
Exploitation
- Unauthenticated exploitation is possible (CVSS 9.8, PR:N, UI:N).
- A public proof-of-concept exists.
- No confirmed in-the-wild exploitation found; not listed in the CISA KEV catalog.
- Whether remote code execution is achievable depends on installed plugins and libraries (gadgets).
Our recommendation
- Check the installed LearnPress version and update to 4.4.11 or later as soon as possible.
- If updating is delayed, apply the workarounds above.
- Review the LearnPress session table for unusual serialized data.
- Check web server logs for POST requests to lp-ajax=checkout from unknown IP addresses.
- Keep current backups before updating and review other LearnPress advisories from 2026.
Public exploits
Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.
- Proof of concept on GitHub (1 repositories)
murrez/CVE-2026-104736
Research sources
- Wordfence advisory www.wordfence.com
- Trac changeset 3750024 plugins.trac.wordpress.org
- Trac class-lp-session-handler.php (4.4.9.1) plugins.trac.wordpress.org
- Trac class-lp-checkout.php (4.4.9.1) plugins.trac.wordpress.org
- GitHub proof-of-concept repository github.com
- thehackerwire CVE-2026-104736 www.thehackerwire.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 17:33.
Original description (NVD)
The LearnPress plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 4.4.10 via deserialization of untrusted input from the 'checkout-email' request parameter during the checkout AJAX action. The value is passed through sanitize_text_field(), which does not strip serialized object syntax, then stored in the LearnPress session table and later fed to LP_Helper::maybe_unserialize() → unserialize() (without an allowed_classes restriction) by LP_Session_Handler::get() on subsequent requests. This makes it possible for unauthenticated attackers to inject a PHP Object.
NVD references (6)
- https://plugins.trac.wordpress.org/browser/learnpress/tags/4.4.9.1/inc/class-lp-ajax.php#L21
- https://plugins.trac.wordpress.org/browser/learnpress/tags/4.4.9.1/inc/class-lp-checkout.php#L377
- https://plugins.trac.wordpress.org/browser/learnpress/tags/4.4.9.1/inc/class-lp-checkout.php#L523
- https://plugins.trac.wordpress.org/browser/learnpress/tags/4.4.9.1/inc/class-lp-session-handler.php#L373
- https://plugins.trac.wordpress.org/changeset?reponame=&old=3750024%40learnpress&new=3750024%40learnpress
- https://www.wordfence.com/threat-intel/vulnerabilities/id/3e28e008-0ec1-4262-9ac0-6170cf8b8bdf?source=cve
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.