PatchSiren cyber security CVE debrief
CVE-2026-7566 thimpress CVE debrief
The LearnPress – Backup & Migration Tool plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.1.4 via deserialization of untrusted input. This makes it possible for authenticated attackers, with administrator-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site.
- Vendor
- thimpress
- Product
- LearnPress – Backup & Migration Tool
- CVSS
- MEDIUM 6.6
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-06-06
- Original CVE updated
- 2026-07-23
- Advisory published
- 2026-06-06
- Advisory updated
- 2026-07-23
Who should care
Administrators of WordPress sites using the LearnPress – Backup & Migration Tool plugin, especially those with administrator-level access and above.
Technical summary
The vulnerability is caused by the deserialization of untrusted input, allowing for PHP Object Injection. The CVSS score is 6.6 (Medium) with a vector of CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H.
Defensive priority
Medium
Recommended defensive actions
- Update to a patched version of the LearnPress – Backup & Migration Tool plugin (version 4.1.5 or later).
- Review and update other plugins and themes for potential POP chain vulnerabilities.
- Restrict administrator-level access and above to trusted users only.
Evidence notes
The vulnerability was reported by [email protected] and has a CVE score of 6.6 (Medium).
Sources and references
Verified primary and authoritative sources
-
CVE-2026-7566 CVE Program record
Publisher, destination, and source semantics verified
URL: https://www.cve.org/CVERecord?id=CVE-2026-7566
CVE Program - Official CVE Program record with source-provided CVE metadata.
-
CVE-2026-7566 NVD vulnerability detail
Publisher, destination, and source semantics verified
URL: https://nvd.nist.gov/vuln/detail/CVE-2026-7566
NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.
Supplemental references
-
Source reference
Unverified legacy reference
URL: https://plugins.trac.wordpress.org/browser/learnpress-import-export/tags/4.1.1/inc/admin/providers/learnpress/class-lp-import-learnpress.php
-
Source reference
Unverified legacy reference
URL: https://plugins.trac.wordpress.org/browser/learnpress-import-export/tags/4.1.1/inc/parsers.php
-
Source reference
Unverified legacy reference
URL: https://plugins.trac.wordpress.org/browser/learnpress-import-export/tags/4.1.4/inc/admin/providers/learnpress/class-lp-import-learnpress.php
-
Source reference
Unverified legacy reference
URL: https://plugins.trac.wordpress.org/browser/learnpress-import-export/tags/4.1.4/inc/parsers.php
-
Source reference
Unverified legacy reference
URL: https://plugins.trac.wordpress.org/browser/learnpress-import-export/tags/4.1.5/inc/functions.php
-
Source reference
Unverified legacy reference
URL: https://plugins.trac.wordpress.org/browser/learnpress-import-export/trunk/inc/admin/providers/learnpress/class-lp-import-learnpress.php
-
Source reference
Unverified legacy reference
URL: https://plugins.trac.wordpress.org/browser/learnpress-import-export/trunk/inc/parsers.php
Methodology and review provenance
AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.