WordPress security changelog
CRITICAL CVE-2026-104736 Deferred

LearnPress – WordPress LMS Plugin for Create and Sell Online Courses: PHP object injection

The LearnPress plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 4.4.10 via deserialization of untrusted input from the 'checkout-email' request parameter during the checkout AJAX action. The value is passed through sanitize_text_field(), which does not strip serialized object syntax, then stored in the LearnPress session table and later fed to LP_Helper::maybe_unserialize() → unserialize() (without an allowed_classes restriction) by LP_Session_Handler::get() on subsequent requests. This makes it possible for unauthenticated attackers to inject a PHP Object. PHP object injection does not by itself establish arbitrary code execution; the export does not identify a usable object chain or its downstream effects. The export supplies no additional endpoint, action, parameter or function details beyond those described above.

CVE / CNA score 9.8 CVSS 3.1 · security@wordfence.com
NVD score Pending NVD has not published its own CVSS assessment.
Component
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
Plugin slug
learnpress
Affected
<= 4.4.10
Safe version
See mitigation notes
Published
Oct 17, 2026
Weakness
CWE-502 — Deserialization of Untrusted Data

This CVE was published Oct 17, 2026 and is one of 94 known issues for this plugin.

What to do

Update, patch or deactivate.

Official author notes reviewed on 2026-10-17 through 4.4.11 did not establish a fixed version for this CVE. Generic security acknowledgments do not identify checkout-email/session deserialization. This archive's uncertainty does not establish that the current release remains vulnerable. Consult the author for current remediation guidance; restrict or disable affected functionality when warranted. Official notes: https://wordpress.org/plugins/learnpress/#developers. Do not deserialize attacker-controlled checkout/session values as PHP objects; ordinary text sanitization is not an object-deserialization safeguard.

No confirmed safe version is listed. Consider a vendor-supported patch or temporarily restricting the affected functionality while you assess the risk.

Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.

Source record

Technical description

The LearnPress plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 4.4.10 via deserialization of untrusted input from the 'checkout-email' request parameter during the checkout AJAX action. The value is passed through sanitize_text_field(), which does not strip serialized object syntax, then stored in the LearnPress session table and later fed to LP_Helper::maybe_unserialize() → unserialize() (without an allowed_classes restriction) by LP_Session_Handler::get() on subsequent requests. This makes it possible for unauthenticated attackers to inject a PHP Object.

CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

Primary and upstream sources