CVE-2026-104736: LearnPress PHP Injection
TL;DR - CVE-2026-104736 is a critical, unauthenticated PHP object injection flaw in LearnPress versions up to and including 4.4.10. - No fixed version, verified public PoC, or confirmed in-the-wild exploitation was identified. - Treat affected installations as high priority: restrict exposure, monitor checkout traffic, and patch when the vendor release is confirmed.
Vulnerability at a Glance
| Field | Details |
|---|---|
| CVE | CVE-2026-104736 |
| Product | LearnPress WordPress plugin |
| Affected versions | Up to and including 4.4.10 |
| CVSS score | 9.8, Critical |
| CVSS vector | Not included in the retrieved NVD record |
| Attack vector | Network-based HTTP request path, based on the affected checkout AJAX functionality; exact vector string was not published |
| Authentication required | No, according to the NVD description |
| Patch available | No confirmed fixed version identified |
| CISA KEV status | Not listed; on_kev: false |
CVE-2026-104736 affects LearnPress, a WordPress learning-management plugin associated with the ThimPress ecosystem. The vulnerable processing path starts with the checkout-email request parameter during checkout AJAX processing and continues through LearnPress session storage and retrieval.
The score is critical because the vulnerability is described as remotely reachable without authentication. The available record does not establish a complete remote-code-execution chain, identify a specific gadget chain, or confirm exploitation against production sites. Defenders should distinguish the confirmed unsafe deserialization condition from impact scenarios that depend on objects and gadget chains available in each WordPress environment.
What Is This Vulnerability?
The root cause is unsafe deserialization of attacker-controlled data. LearnPress processes the checkout-email parameter with WordPress’s sanitize_text_field() function, but that sanitization does not remove PHP serialized-object syntax. The resulting value is stored in the LearnPress session table instead of being rejected as an invalid checkout value.
On a later request, LP_Session_Handler::get() retrieves the stored value and passes it through LP_Helper::maybe_unserialize(). The data then reaches PHP’s unserialize() function without an allowed_classes restriction. An unauthenticated attacker can therefore inject a PHP object into the application’s session-handling workflow.
Technical Notes
The vulnerable processing chain can be represented as follows:
Unauthenticated HTTP request
|
v
checkout-email parameter
|
v
sanitize_text_field()
|
v
LearnPress session table
|
v
LP_Session_Handler::get()
|
v
LP_Helper::maybe_unserialize()
|
v
unserialize() without allowed_classes restriction
PHP object injection does not automatically prove remote code execution. Exploitation generally requires a usable gadget chain in the target application, its plugins, themes, or included libraries. The NVD description confirms the object-injection condition but does not provide a gadget chain, payload, or verified end-to-end exploit.
Analyst’s Take: Treat the unauthenticated deserialization path as the immediate remediation concern, not as proof of a completed remote-code-execution chain. The lack of a confirmed public PoC or in-the-wild exploitation lowers the available evidence of active abuse, but it does not make LearnPress versions up to and including 4.4.10 safe to leave exposed.
Who Is Affected?
The authoritative affected range available for this CVE is LearnPress version 4.4.10 and earlier. The vulnerable functionality is associated with checkout AJAX processing and LearnPress session handling. Any WordPress site running LearnPress within that range should be treated as exposed unless the site owner has independently verified a vendor fix or applied a documented code-level remediation.
The available data does not establish that every WordPress installation using LearnPress is exploitable to the same degree. Impact can vary according to enabled plugins, themes, PHP version, filesystem permissions, web-server configuration, and available PHP object gadget chains. Those differences do not make an affected version safe; they only affect the likely consequence after successful object injection.
A separate search result associated LearnPress with a range ending at 4.4.9.1, but that range was not used for this CVE assessment. Administrators should rely on the NVD-reported range of up to and including 4.4.10, not the narrower third-party result.
Technical Notes
Inventory LearnPress installations through WP-CLI or the WordPress administration interface:
wp plugin list --fields=name,status,version,update
wp plugin get learnpress --fields=name,status,version
Escalate a site for immediate review when the learnpress plugin is installed and its version is 4.4.10 or lower. Do not assume that an inactive plugin is harmless without checking whether its files remain reachable or whether another component loads its code.
CVSS Score Breakdown
The NVD record rates CVE-2026-104736 at CVSS 9.8 Critical. The retrieved record did not include the full CVSS vector string, so the individual official metric values cannot be independently reproduced from the supplied data. An inferred vector should not be treated as an authoritative NVD metric.
The available description establishes several characteristics that explain the high severity: the vulnerable path is remotely reachable through HTTP, authentication is not required, and attacker-controlled data reaches unrestricted PHP deserialization. The record does not, by itself, confirm a complete remote-code-execution payload or the exact scope and impact metrics used to calculate 9.8.
| CVSS-related characteristic | Available assessment |
|---|---|
| Remote reachability | Supported by the HTTP checkout AJAX path |
| Authentication | Not required, according to NVD |
| User interaction | Not established in the supplied record |
| Privileges required | Not independently stated in the supplied record |
| Confidentiality, integrity, availability impact | Exact metric values unavailable |
| Official vector string | Not provided in the retrieved NVD response |
Because the vector is unavailable, security teams should record the score as CVSS 9.8 Critical while preserving the distinction between published facts and inferred metrics. Risk prioritization should also account for whether the site is internet-facing, whether LearnPress checkout is enabled, and whether the WordPress process has excessive filesystem or database privileges.
Exploitation Status
CVE-2026-104736 was not listed in CISA’s Known Exploited Vulnerabilities catalog in the supplied lookup. The reported status was on_kev: false, with no date added, due date, required action, or ransomware campaign flag. There is no CISA KEV remediation deadline associated with this entry at the time of assessment.
No verified public proof of concept or exploit repository was identified in the supplied research. No confirmed in-the-wild exploitation was established either. The absence of a KEV entry or public PoC is not evidence that exploitation is impossible or that the vulnerability has never been targeted; it means confirmation was not available from the reviewed sources.
Technical Notes
Use the following status record in an incident or vulnerability ticket:
CVE: CVE-2026-104736
CISA KEV: Not listed
Confirmed in-the-wild exploitation: Not established
Verified public PoC: Not identified
Affected range: LearnPress <= 4.4.10
Fixed version: Not identified
Continue monitoring vendor advisories, NVD updates, CISA catalog changes, WordPress security reporting, and threat-intelligence feeds. A newly published PoC or a confirmed fixed release would materially change remediation priority and detection requirements.
If suspicious activity is identified, follow a documented OT incident response planning process adapted to the affected WordPress environment. Preserve logs and system evidence before making changes whenever possible.
How to Detect It
Detection should focus on requests to WordPress checkout AJAX functionality that contain a suspicious checkout-email parameter, especially when the value contains PHP serialization markers. A single marker is not conclusive because application traffic can be encoded, transformed, or logged incompletely. Repeated requests from the same source, or requests followed by unusual PHP activity, deserve investigation.
Review web-server, WAF, WordPress, database, and host telemetry together. Look for requests followed by unexpected LearnPress session-table writes, PHP worker errors, new files, privilege changes, outbound connections, or administrative activity. The vulnerable value may be stored and deserialized on a later request, so the initial request and subsequent application behavior may occur at different times.
Technical Notes
A generic web-server or WAF search can identify likely probes without assuming a vendor-specific action name:
grep -Eai 'checkout-email=.*(O:[0-9]+:|C:[0-9]+:|a:[0-9]+:|s:[0-9]+:)' \\
/var/log/nginx/access.log \\
/var/log/apache2/access.log
For centralized HTTP telemetry, an illustrative Sigma-style detection is:
title: Suspected LearnPress PHP Object Injection Probe
logsource:
category: webserver
detection:
selection_parameter:
url|contains: "checkout-email="
selection_serialized:
url|re: "(^|[^A-Za-z])(O|C|a|s):[0-9]+:"
condition: selection_parameter and selection_serialized
level: high
The query is a starting point, not a complete exploit signature. URL encoding, POST-body logging limitations, reverse proxies, and WAF normalization can prevent the serialized value from appearing in ordinary access logs. If request bodies are not retained, use WAF inspection logs or application-level telemetry where legally and operationally appropriate.
Mitigation and Patching
The affected range is LearnPress up to and including 4.4.10. A specific fixed version was not identified in the retrieved NVD record, and the referenced source pages could not be independently extracted during collection because requested HTTP retrievals returned 403 Forbidden. Do not claim that a particular LearnPress release resolves this CVE until the vendor or a trusted advisory identifies the fixed version.
Until a fixed release is confirmed, reduce exposure to the WordPress installation where feasible. Restrict administrative and checkout access at the reverse proxy or WAF, disable LearnPress if the business can tolerate the impact, and preserve evidence before making changes if compromise is suspected. Keep WordPress, PHP, plugins, and themes current because other installed components may provide object-injection gadget chains.
Organizations investigating potentially compromised endpoints may also consider reputable malware-detection tooling such as Malwarebytes as one layer of a broader incident-response process. Endpoint scanning does not replace log review, vulnerability remediation, or forensic analysis.
Technical Notes
First verify the installed version and whether an update is available through the configured WordPress update channel:
wp plugin get learnpress --fields=name,status,version
wp plugin update learnpress --dry-run
If the site can temporarily operate without LearnPress, deactivate it as an emergency containment measure:
wp plugin deactivate learnpress
Reactivate it only after a confirmed vendor-fixed release is available and the site has been checked for compromise:
wp plugin activate learnpress
wp plugin get learnpress --fields=name,status,version
These commands do not establish that a fixed release exists. wp plugin update learnpress should be used only after confirming that the available package is a vendor-supported remediation and testing it in a staging environment:
wp plugin update learnpress
If deactivation is not possible, apply access controls that limit public checkout functionality and monitor requests containing checkout-email. Do not attempt an ad hoc replacement of unserialize() or a database transformation in production without a tested vendor-supported procedure. Malformed session data and application compatibility issues can cause outages or destroy forensic evidence.
References
The primary reference is the NVD record for CVE-2026-104736, which identifies the LearnPress affected range, unauthenticated attack condition, CVSS 9.8 rating, and unsafe deserialization path:
The NVD-provided source references point to LearnPress AJAX, checkout, session-handler, and WordPress.org changeset locations. The collected research reported HTTP 403 responses when attempting to retrieve the first two requested source references, so defenders should review those pages directly when accessible:
- LearnPress AJAX source reference
- LearnPress checkout source reference
- Additional checkout source reference
- LearnPress session-handler source reference
- WordPress.org changeset reference
- CISA Known Exploited Vulnerabilities Catalog
As of the assessment date, no confirmed fixed version, verified public PoC, or confirmed in-the-wild exploitation was established from the supplied sources. Reassess these facts when the vendor, NVD, or CISA publishes updates.
This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.