CVE-2026-104736: PHP Object Injection in LearnPress WordPress Plugin

The LearnPress plugin for WordPress, in versions up to and including 4.4.10, contains a critical PHP Object Injection vulnerability (CVE-2026-104736). An unauthenticated attacker can exploit this vulnerability by submitting a maliciously crafted serialized object via the 'checkout-email' parameter during the checkout AJAX action.

The application processes this input using sanitize_text_field(), which fails to strip serialized object syntax. The payload is subsequently saved to the LearnPress session table. During later requests, the LP_Session_Handler::get() method retrieves this data and passes it to LP_Helper::maybe_unserialize(), which invokes the PHP unserialize() function without any class-based restrictions. This lack of sanitization allows an attacker to control the deserialization process, potentially leading to remote code execution (RCE) or other unintended application states depending on the available gadget chains within the environment.

Impact

Successful exploitation allows unauthenticated remote attackers to execute arbitrary code or manipulate application objects, posing a severe risk to the integrity and confidentiality of WordPress sites utilizing the LearnPress plugin. The CVSS base score of 9.8 indicates the high severity of this vulnerability, which affects all sites running vulnerable versions of the plugin.

Recommendation

Prioritized actions for detection and remediation:

• Upgrade the LearnPress plugin to a version patched against CVE-2026-104736 immediately.
• Monitor webserver logs for suspicious POST requests containing serialized PHP object structures in the 'checkout-email' parameter.
• Audit the WordPress database for the LearnPress session table to identify any anomalous, persistent serialized object entries injected by unauthenticated sources.