CVE-2026-7566: LearnPress – Backup & Migration Tool <= 4.1.4 - Authenticated (Administrator+) PHP Object Injection via WXR XML File Upload
The LearnPress – Backup & Migration Tool plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.1.4 via deserialization of untrusted input . This makes it possible for authenticated attackers, with administrator-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
LearnPress – Backup & Migration Toolfrom your environment.Uninstall the LearnPress – Backup & Migration Tool plugin from the WordPress site if it is not required. The vulnerability affects all versions up to and including 4.1.4.
- Configuration
Disable or block the WXR (WordPress eXtended RSS) XML file upload/import feature for this plugin to prevent deserialization of untrusted input (affects versions up to and including 4.1.4). If the plugin provides no setting, prevent upload of .xml/.wxr files via other means (file upload restrictions or disabling the importer).
LearnPress – Backup & Migration Tool WXR XML file upload/import = disabled - Compensating control
Restrict access to WordPress administrator accounts and the dashboard (for example, limit admin access to trusted IPs via firewall, VPN, or WAF) to reduce exposure to authenticated attackers who could exploit this issue.
- Compensating control
Audit installed plugins and themes for known gadget/POP chains and remove or update any additional components that could provide a POP chain — the vulnerability only has impact if a POP chain exists in another plugin or theme.
- Operational
Search logs and recent uploads/imports for WXR/XML files and review/remove any untrusted or unexpected uploaded WXR files; review administrator account activity for suspicious actions if the plugin was present (affected versions up to and including 4.1.4).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-7566?
The severity of CVE-2026-7566 is classified as medium, with a score of 6.6.
How do I fix CVE-2026-7566?
To resolve CVE-2026-7566, you should update the LearnPress – Backup & Migration Tool plugin to the latest version that is not vulnerable, specifically version 4.1.5 or later.
Who is affected by CVE-2026-7566?
CVE-2026-7566 affects authenticated users with administrator-level access and above using the LearnPress – Backup & Migration Tool plugin.
What type of vulnerability is CVE-2026-7566?
CVE-2026-7566 is a PHP Object Injection vulnerability caused by the deserialization of untrusted input.
What are the potential impacts of CVE-2026-7566?
The potential impacts of CVE-2026-7566 include the ability for an authenticated attacker to execute arbitrary PHP code, which could lead to a complete site compromise.