{"id":"CVE-2026-104736","kind":"vulnerability","aliases":["CVE-2026-104736"],"related":[],"title":"The LearnPress plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 4.4.10…","description":"The LearnPress plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 4.4.10 via deserialization of untrusted input from the 'checkout-email' request parameter during the checkout AJAX action. The value is passed through sanitize_text_field(), which does not strip serialized object syntax, then stored in the LearnPress session table and later fed to LP_Helper::maybe_unserialize() → unserialize() (without an allowed_classes restriction) by LP_Session_Handler::get() on subsequent requests. This makes it possible for unauthenticated attackers to inject a PHP Object.","summary":"The LearnPress WordPress plugin up to and including 4.4.10 passes an unauthenticated checkout-email parameter through unserialize() without restriction. An attacker can inject a PHP object, which can lead to code execution if a usable gadget chain exists on the site.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["learnpress","package","php","wordpress"],"not_affected_if":["learnpress-not-installed","version-above-4.4.10"],"how_to_check":"In the WordPress admin Plugins screen, check whether LearnPress is installed at version 4.4.10 or lower.","fix":"Update LearnPress to a release newer than 4.4.10; the fixed version is unknown from the sources.","status":"open","published_at":"2026-10-17T04:16:47+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","triaged_at":"2026-10-23T22:04:54+00:00","updated_at":"2026-10-23T22:28:55+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-23T22:04:54Z","model":"claude-haiku-5-5","output":{"fix":"Update LearnPress to a release newer than 4.4.10; the fixed version is unknown from the sources.","reach":"internet","impact":"high","summary":"The LearnPress WordPress plugin up to and including 4.4.10 passes an unauthenticated checkout-email parameter through unserialize() without restriction. An attacker can inject a PHP object, which can lead to code execution if a usable gadget chain exists on the site.","category":"package","who_cares":["wordpress","learnpress","php"],"confidence":0.8,"needs_auth":"no","worst_case":"Unauthenticated attacker injects PHP objects into the WordPress server.","analyst_note":"Find the first fixed LearnPress version on the wordpress.org plugin changelog; the only source given is the NVD entry.","how_to_check":"In the WordPress admin Plugins screen, check whether LearnPress is installed at version 4.4.10 or lower.","needs_analyst":true,"not_affected_if":["learnpress-not-installed","version-above-4.4.10"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.001123,"input_tokens":2872,"output_tokens":1672,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-104736':21A,24A '-2026':20A,23A '4.4.10':18A,37B,88C 'action':105C 'ajax':104C 'allow':139C 'attack':50B,156C 'chain':66B 'checkout':42B,97C,103C 'checkout-email':41B,96C 'class':140C 'code':60B 'cve':19A,22A 'deseri':90C 'email':43B,98C 'execut':61B 'exist':67B 'fed':130C 'field':113C 'gadget':65B 'get':146C 'handler':145C 'helper':133C 'includ':17A,36B,87C 'inject':11A,52B,81C,158C 'input':93C 'later':129C 'lead':58B 'learnpress':2A,25B,30B,72C,125C 'lp':132C,143C 'make':151C 'mayb':134C 'object':10A,55B,80C,119C,161C 'packag':26B 'paramet':44B,100C 'pass':38B,109C 'php':9A,27B,54B,79C,160C 'plugin':3A,32B,73C 'possibl':153C 'request':99C,149C 'restrict':48B,141C 'sanit':111C 'serial':118C 'session':126C,144C 'site':70B 'store':122C 'strip':117C 'subsequ':148C 'syntax':120C 'tabl':127C 'text':112C 'unauthent':40B,155C 'unseri':46B,135C,136C 'untrust':92C 'usabl':64B 'valu':107C 'version':13A,83C 'via':89C 'vulner':7A,77C 'without':47B,137C 'wordpress':5A,28B,31B,75C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-17T04:16:47+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-104736","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104736","severity":null,"published_at":"2026-10-17T04:16:47+00:00","modified_at":"2026-10-19T15:16:45+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}