LearnPress for WordPress Hit by Critical Unauthenticated PHP Object Injection (CVE-2026-104736)

CVE-2026-104736 is a critical (CVSS 9.8) PHP Object Injection flaw in the LearnPress WordPress LMS plugin through version 4.4.10. Unauthenticated attackers can trigger it through the checkout AJAX action.

What Is It

CVE-2026-104736 is a deserialization-of-untrusted-data weakness (CWE-502) in LearnPress, the "WordPress LMS Plugin for Create and Sell Online Courses" by ThimPress. Wordfence reported it, and NVD published it on 2026-10-17.

The flaw is in the checkout-email request parameter used during the checkout AJAX action:

• The plugin passes the value through sanitize_text_field(), which does not remove serialized object syntax.
• It then stores the value in the LearnPress session table.
• On later requests, LP_Session_Handler::get() passes the stored value to LP_Helper::maybe_unserialize(), which calls unserialize() with no allowed_classes restriction.

As a result, an unauthenticated attacker can inject a PHP object into the application. How much damage this causes in practice depends on whether a usable property-oriented programming (POP) gadget chain is present on the target site, either in LearnPress itself or in another installed plugin or theme. Without one, injecting an object may have little or no direct effect. With one, it could lead to outcomes such as deleting files, retrieving sensitive data or running code. The supplied sources do not confirm whether a usable gadget chain exists in typical deployments.

Why It Matters

The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. That means:

• the attack works over the network
• it is not complex to carry out
• it needs no privileges or user interaction
• it has high impact on confidentiality, integrity and availability

The checkout endpoint is reachable without logging in, so any public site running a vulnerable version is exposed.

As of this writing, CVE-2026-104736 is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The supplied sources do not confirm active exploitation. NVD lists the record's status as "Received," meaning NVD has not yet completed its analysis.

What's Vulnerable

• Vendor: thimpress
• Product: LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
• Affected versions: all versions up to and including 4.4.10

Code references in the record point to class-lp-ajax.php, class-lp-checkout.php and class-lp-session-handler.php in the LearnPress 4.4.9.1 source tag.

Patch Status

The supplied records do not name a specific fixed release. The affected range ends at 4.4.10, and the record links to a WordPress plugin Trac changeset for LearnPress. Because there is no KEV entry, CISA has not set a required action or due date.

Site owners should:

• check whether they run LearnPress 4.4.10 or earlier
• update to a release newer than 4.4.10 once it is available
• check the Wordfence advisory to confirm the fixed version

Sources

• NVD – CVE-2026-104736
• Wordfence Threat Intel advisory
• WordPress Plugin Trac – LearnPress changeset
• WordPress Plugin Trac – class-lp-ajax.php (4.4.9.1)
• WordPress Plugin Trac – class-lp-checkout.php (4.4.9.1), L377
• WordPress Plugin Trac – class-lp-checkout.php (4.4.9.1), L523
• WordPress Plugin Trac – class-lp-session-handler.php (4.4.9.1)