{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3alearnpresslearnpresswordpress/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:learnpress:learnpress:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":9.8,"id":"CVE-2026-104736"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["LearnPress (\u003c= 4.4.10)"],"_cs_severities":["critical"],"_cs_tags":["web-vulnerability","php-deserialization","wordpress","cve-2026-104736"],"_cs_type":"advisory","_cs_vendors":["WordPress"],"content_html":"\u003cp\u003eThe LearnPress plugin for WordPress, in versions up to and including 4.4.10, contains a critical PHP Object Injection vulnerability (CVE-2026-104736). An unauthenticated attacker can exploit this vulnerability by submitting a maliciously crafted serialized object via the 'checkout-email' parameter during the checkout AJAX action.\u003c/p\u003e\n\u003cp\u003eThe application processes this input using sanitize_text_field(), which fails to strip serialized object syntax. The payload is subsequently saved to the LearnPress session table. During later requests, the LP_Session_Handler::get() method retrieves this data and passes it to LP_Helper::maybe_unserialize(), which invokes the PHP unserialize() function without any class-based restrictions. This lack of sanitization allows an attacker to control the deserialization process, potentially leading to remote code execution (RCE) or other unintended application states depending on the available gadget chains within the environment.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthenticated remote attackers to execute arbitrary code or manipulate application objects, posing a severe risk to the integrity and confidentiality of WordPress sites utilizing the LearnPress plugin. The CVSS base score of 9.8 indicates the high severity of this vulnerability, which affects all sites running vulnerable versions of the plugin.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritized actions for detection and remediation:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade the LearnPress plugin to a version patched against CVE-2026-104736 immediately.\u003c/li\u003e\n\u003cli\u003eMonitor webserver logs for suspicious POST requests containing serialized PHP object structures in the 'checkout-email' parameter.\u003c/li\u003e\n\u003cli\u003eAudit the WordPress database for the LearnPress session table to identify any anomalous, persistent serialized object entries injected by unauthenticated sources.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-17T04:47:50Z","date_published":"2026-10-17T04:47:50Z","id":"https://feed.craftedsignal.io/briefs/2026-10-learnpress-deserialization/","summary":"The LearnPress plugin for WordPress is vulnerable to unauthenticated PHP Object Injection via the 'checkout-email' parameter, allowing remote attackers to trigger insecure deserialization.","title":"CVE-2026-104736: PHP Object Injection in LearnPress WordPress Plugin","url":"https://feed.craftedsignal.io/briefs/2026-10-learnpress-deserialization/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:learnpress:learnpress:*:*:*:*:*:wordpress:*:*","version":"https://jsonfeed.org/version/1.1"}