Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

LearnPress plugin allows attackers to run code via email field

CVE-2026-104736 · published 1 day ago
Summary

The LearnPress learning management plugin for WordPress lets anyone send specially crafted data in the checkout email field, which the system stores and later processes without proper checks. This can let an attacker cause the website to execute unwanted code, potentially compromising data or site functionality. Update the plugin beyond version 4.4.10 or apply the vendor's patch as soon as possible.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
thimpress learnpress – wordpress lms plugin for create and sell online courses <= 4.4.10
Original advisory text
LearnPress <= 4.4.10 - Unauthenticated PHP Object Injection via 'checkout-email' Parameter
The LearnPress plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 4.4.10 via deserialization of untrusted input from the 'checkout-email' request parameter during the checkout AJAX action. The value is passed through sanitize_text_field(), which does not strip serialized object syntax, then stored in the LearnPress session table and later fed to LP_Helper::maybe_unserialize() → unserialize() (without an allowed_classes restriction) by LP_Session_Handler::get() on subsequent requests. This makes it possible for unauthenticated attackers to inject a PHP Object.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
9.8 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-502Deserialization of Untrusted Data
Timeline
Published17 Oct 2026
Updated18 Oct 2026
First seen17 Oct 2026
Sources
CVE-2026-104736 · NVD
CVE-2026-104736 · MITRE
Track software like this
Free during beta