LearnPress up to 4.4.10 – Unauthenticated PHP Object Injection (CVE-2026-104736)

LearnPress versions through 4.4.10 contain a critical unauthenticated PHP object injection vulnerability in the checkout session flow. CVE-2026-104736 has a CVSS score of 9.8. LearnPress 4.4.11 contains the security fix, and sites using the plugin should update immediately.

Vulnerability summary

• Product: LearnPress – WordPress LMS Plugin
• Plugin slug: learnpress
• Affected versions: 4.4.10 and earlier
• Fixed version: 4.4.11
• CVE: CVE-2026-104736
• Severity: Critical, CVSS 9.8
• Authentication required: No
• Affected input: checkout-email during the LearnPress checkout AJAX action
• Vulnerability class: Deserialization of untrusted data / PHP object injection

Exploit path and prerequisites

Wordfence reports that LearnPress passes the attacker-controlled checkout-email value through sanitize_text_field(). That function does not remove PHP serialized-object syntax. The value is stored in the LearnPress session table and is later passed through LP_Helper::maybe_unserialize() to PHP unserialize() without restricting allowed classes.

This permits an unauthenticated visitor to inject a PHP object through the public checkout workflow. The final impact of PHP object injection depends on whether a usable property-oriented programming chain is available among the classes loaded by WordPress, LearnPress, the active theme, or other plugins. A viable chain can potentially turn object injection into file deletion, data modification, or remote code execution. The 9.8 CVSS rating reflects the high potential impact of the reachable unauthenticated deserialization path.

Immediate remediation

1. Update LearnPress to version 4.4.11 or later. WordPress.org lists 4.4.11 as the current fixed release.
2. If the update cannot be applied immediately, deactivate LearnPress or disable public LearnPress checkout functionality until the site is patched.
3. Purge page, object, and CDN caches after updating so no stale checkout behavior remains available.
4. Review web access logs and security telemetry for unusual anonymous LearnPress checkout AJAX requests, especially repeated requests containing abnormal values in the checkout email field.
5. If suspicious activity is found, inspect recently modified files, new administrator accounts, scheduled tasks, and outbound connections, then rotate credentials appropriate to the evidence.

Verification and investigation

wp plugin get learnpress --fields=name,status,version,update,update_version
wp user list --role=administrator --fields=ID,user_login,user_email,user_registered
wp cron event list
wp core verify-checksums
wp plugin verify-checksums learnpress
find wp-content -type f -mtime -14 -print

Confirm the installed LearnPress version is at least 4.4.11. Checksum verification can identify modified plugin files, but it does not prove that a site was never exploited. Investigate file timestamps and account changes in context with web-server, PHP, firewall, and WordPress activity logs.

Indicators to review

• Repeated anonymous requests to LearnPress checkout AJAX functionality with malformed or unusually long checkout email values
• Unexpected LearnPress session records created shortly before suspicious server behavior
• New administrator accounts, unfamiliar plugins, modified PHP files, or unexpected cron events
• PHP errors or warnings involving unserialize(), incomplete objects, magic methods, or LearnPress session handling
• Outbound connections or file changes temporally associated with suspicious checkout requests

Sources

• Wordfence Intelligence vulnerability record
• WordPress.org LearnPress page and 4.4.11 changelog
• WordPress Plugin Repository session-handler source
• CVE-2026-104736 record
• CISA Known Exploited Vulnerabilities catalog