If the site administrator has enabled the guest checkout feature, an unauthenticated attacker can exploit this flaw to inject arbitrary malicious web scripts. Even if guest checkout is disabled, any registered user with Subscriber-level privileges can trigger the injection during the checkout process. Once the script is stored, it executes in the browser of any user (such as an administrator or other customers) who accesses the affected checkout or order comment pages. This can lead to account takeover, sensitive data theft, or unauthorized actions performed on behalf of the victim.

Impact

Successful exploitation allows for the execution of malicious scripts in the context of other users on the WordPress site. In multi-user environments such as LMS platforms, this poses a high risk to administrative sessions and sensitive user data. The impact is significant for organizations relying on LearnPress to manage course transactions and user profiles, as attackers could potentially compromise high-privileged accounts or intercept payment-related comments.

Recommendation

1. Update the LearnPress plugin immediately to a version newer than 4.4.10.
2. Until a patch is applied, disable the guest checkout functionality to restrict the exploit surface to authenticated users.
3. Monitor web server logs for suspicious POST requests to the checkout and REST API endpoints that include scripts or HTML tags.
4. Implement a robust Content Security Policy (CSP) to mitigate the impact of XSS attacks by restricting where scripts can be loaded from and executed.

The application processes this input using sanitize_text_field(), which fails to strip serialized object syntax. The payload is subsequently saved to the LearnPress session table. During later requests, the LP_Session_Handler::get() method retrieves this data and passes it to LP_Helper::maybe_unserialize(), which invokes the PHP unserialize() function without any class-based restrictions. This lack of sanitization allows an attacker to control the deserialization process, potentially leading to remote code execution (RCE) or other unintended application states depending on the available gadget chains within the environment.

Impact

Successful exploitation allows unauthenticated remote attackers to execute arbitrary code or manipulate application objects, posing a severe risk to the integrity and confidentiality of WordPress sites utilizing the LearnPress plugin. The CVSS base score of 9.8 indicates the high severity of this vulnerability, which affects all sites running vulnerable versions of the plugin.

Recommendation

Prioritized actions for detection and remediation:

• Upgrade the LearnPress plugin to a version patched against CVE-2026-104736 immediately.
• Monitor webserver logs for suspicious POST requests containing serialized PHP object structures in the 'checkout-email' parameter.
• Audit the WordPress database for the LearnPress session table to identify any anomalous, persistent serialized object entries injected by unauthenticated sources.