CVE-2026-104736: LearnPress <= 4.4.10 - Unauthenticated PHP Object Injection via 'checkout-email' Parameter
The LearnPress plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 4.4.10 via deserialization of untrusted input from the 'checkout-email' request parameter during the checkout AJAX action. The value is passed through sanitizetextfield(), which does not strip serialized object syntax, then stored in the LearnPress session table and later fed to LPHelper::maybeunserialize() → unserialize() (without an allowedclasses restriction) by LPSessionHandler::get() on subsequent requests. This makes it possible for unauthenticated attackers to inject a PHP Object.
Affected Software
Event History
Frequently Asked Questions
What must an attacker be able to do to exploit this issue?
An attacker only needs network access to the affected WordPress site and can exploit the issue without authentication or user interaction. The malicious serialized value is supplied through the checkout AJAX action using the checkout-email parameter.
Are sites affected by default?
The described vulnerable path is part of LearnPress checkout processing and does not state any additional configuration prerequisite. LearnPress versions up to and including 4.4.10 are affected according to the available data.
How can I determine whether exploitation attempts may have occurred?
Review checkout AJAX requests and LearnPress session-table entries for suspicious serialized PHP object syntax in values associated with the checkout-email parameter. The supplied data is stored in the LearnPress session table and deserialized on subsequent requests.
What is the immediate mitigation if updating is not possible?
No supported workaround is provided in the available data. Prioritize preventing unauthenticated access to the affected checkout AJAX path until the vulnerable LearnPress version can be replaced or updated.