CVE-2026-104736 thimpress CVE debrief

Who should care

Defenders responsible for WordPress installations with the LearnPress plugin should assess exposure and prioritize patching or mitigation. Defenders should prioritize verifying exposure and applying patches or mitigations to prevent exploitation. The vulnerability has a CVSS score of 9.8, indicating critical severity. Unauthenticated attackers can inject PHP objects, potentially leading to code execution. The vulnerability can be exploited via the ' value

Why it matters

The LearnPress plugin for WordPress is vulnerable to PHP Object Injection, allowing unauthenticated attackers to inject PHP objects. Defenders should prioritize verifying exposure and applying patches or mitigations to prevent exploitation.

• Unauthenticated attackers can inject PHP objects, potentially leading to code execution.
• The vulnerability can be exploited via the 'checkout-email' request parameter during the checkout AJAX action.
• Defenders should verify exposure and apply patches or mitigations to prevent exploitation.
• The vulnerability has a CVSS score of 9.8, indicating critical severity.

Technical summary

The LearnPress plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 4.4.10. The vulnerability exists due to the deserialization of untrusted input from the 'checkout-email' request parameter during the checkout AJAX action. The input is not properly sanitized and is later fed to LP_Helper::maybe_unserialize() → unserialize() without an allowed_classes restriction.

Defensive priority

Defenders should prioritize verifying exposure and applying patches or mitigations.

Recommended defensive actions

• Verify exposure by checking if the LearnPress plugin version is 4.4.10 or earlier.
• Apply patches or updates to the LearnPress plugin to prevent exploitation.
• Monitor for suspicious activity related to the checkout AJAX action.
• Consider implementing additional security measures, such as input validation and sanitization.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The vulnerability is caused by the deserialization of untrusted input from the 'checkout-email' request parameter, which is not properly sanitized. The input is passed through sanitize_text_field(), which does not strip serialized object syntax, and is later fed to LP_Helper::maybe_unserialize() → unserialize() without an allowed_classes restriction.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.