PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-7566 thimpress CVE debrief

The LearnPress – Backup & Migration Tool plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.1.4 via deserialization of untrusted input. This makes it possible for authenticated attackers, with administrator-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site.

Vendor
thimpress
Product
LearnPress – Backup & Migration Tool
CVSS
MEDIUM 6.6
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-06
Original CVE updated
2026-07-23
Advisory published
2026-06-06
Advisory updated
2026-07-23

Who should care

Administrators of WordPress sites using the LearnPress – Backup & Migration Tool plugin, especially those with administrator-level access and above.

Technical summary

The vulnerability is caused by the deserialization of untrusted input, allowing for PHP Object Injection. The CVSS score is 6.6 (Medium) with a vector of CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H.

Defensive priority

Medium

Recommended defensive actions

  • Update to a patched version of the LearnPress – Backup & Migration Tool plugin (version 4.1.5 or later).
  • Review and update other plugins and themes for potential POP chain vulnerabilities.
  • Restrict administrator-level access and above to trusted users only.

Evidence notes

The vulnerability was reported by [email protected] and has a CVE score of 6.6 (Medium).

Sources and references

Verified primary and authoritative sources

  • CVE-2026-7566 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-7566

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-7566 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-7566

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://plugins.trac.wordpress.org/browser/learnpress-import-export/tags/4.1.1/inc/admin/providers/learnpress/class-lp-import-learnpress.php

    [email protected]

  • Source reference

    Unverified legacy reference

    URL: https://plugins.trac.wordpress.org/browser/learnpress-import-export/tags/4.1.1/inc/parsers.php

    [email protected]

  • Source reference

    Unverified legacy reference

    URL: https://plugins.trac.wordpress.org/browser/learnpress-import-export/tags/4.1.4/inc/admin/providers/learnpress/class-lp-import-learnpress.php

    [email protected]

  • Source reference

    Unverified legacy reference

    URL: https://plugins.trac.wordpress.org/browser/learnpress-import-export/tags/4.1.4/inc/parsers.php

    [email protected]

  • Source reference

    Unverified legacy reference

    URL: https://plugins.trac.wordpress.org/browser/learnpress-import-export/tags/4.1.5/inc/functions.php

    [email protected]

  • Source reference

    Unverified legacy reference

    URL: https://plugins.trac.wordpress.org/browser/learnpress-import-export/trunk/inc/admin/providers/learnpress/class-lp-import-learnpress.php

    [email protected]

  • Source reference

    Unverified legacy reference

    URL: https://plugins.trac.wordpress.org/browser/learnpress-import-export/trunk/inc/parsers.php

    [email protected]

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.