CVE-2026-104736

Published Oct 17, 2026

Last updated 2 days ago

CVSS critical 9.8
lms

Overview

Description
The LearnPress plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 4.4.10 via deserialization of untrusted input from the 'checkout-email' request parameter during the checkout AJAX action. The value is passed through sanitize_text_field(), which does not strip serialized object syntax, then stored in the LearnPress session table and later fed to LP_Helper::maybe_unserialize() → unserialize() (without an allowed_classes restriction) by LP_Session_Handler::get() on subsequent requests. This makes it possible for unauthenticated attackers to inject a PHP Object.
Source
security@wordfence.com
NVD status
Deferred

Risk scores

CVSS 3.1

Type
Secondary
Base score
9.8
Impact score
5.9
Exploitability score
3.9
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity
CRITICAL

Weaknesses

security@wordfence.com
CWE-502

Social media

Hype score
Not currently trending

  1. 🚨 CVE-2026-104736 | Critical (CVSS 9.8) A critical unauthenticated PHP Object Injection vulnerability affects WordPress LearnPress versions ≤ 4.4.10 potentially leading to severe system compromise 🔗 PoC & technical details: https://t.co/0IXojOsuiL #WordPress #CVE #

    @murrezsec

    18 Oct 2026

    206 Impressions

    0 Retweets

    4 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  2. 🆕👉 LearnPress up to 4.4.10 – Unauthenticated PHP Object Injection (CVE-2026-104736) https://t.co/hzfsGsvOtY #loreleiweb LearnPress versions through 4.4.10 contain a critical unauthenticated PHP object injection vulnerability in the checkout session flow. CVE-2026-104736

    @LoreleiWeb

    18 Oct 2026

    223 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  3. High CVSS 9.8 vulnerability (CVE-2026-104736) affects LearnPress WordPress plugin versions up to 4.4.10. Organizations using it should update promptly. via NVD Recent High CVSS #CyberSecurity #InfoSec #Vulnerability https://t.co/LRI5cj2fHV

    @ADKCyber

    18 Oct 2026

    19 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  4. 🚨 Critical #CVE-2026-104736 and #CVE-2026-110653: Unauthenticated Flaws in LearnPress and LatePoint Threatening WordPress Deployments + Video -Prediction: 📈 1 Positive | 📉 1 Negative https://t.co/LzZALOZ28C Educational Purposes!

    @UndercodeUpdate

    17 Oct 2026

    37 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  5. 🚨 CVE-2026-104736 (LearnPress, 9.8) + CVE-2026-110653 (LatePoint, 9.1) — unauthenticated WordPress plugin flaws. Patch to LearnPress 4.4.11 / LatePoint 5.7.5. Full analysis 👇 🔗 https://t.co/uC6jnzrdpV #CyberSecurity #ThreatIntel

    @ThreatAft

    17 Oct 2026

    68 Impressions

    0 Retweets

    1 Like

    0 Bookmarks

    0 Replies

    0 Quotes

Related CVEs

  1. The Tutor LMS WordPress plugin before 4.1.1 does not perform a capability check in a routine that regenerates its managed pages, allowing unauthenticated users to force-publish unpublished pages and overwrite their content, create missing ones, and change the options that reference them.•CVE-2026-96537
  2. The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 10.2.1 via deserialization of untrusted input . This makes it possible for authenticated attackers, with custom-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present. This vulnerability is only exploitable during lesson creation when a temporary lesson ID triggers the custom metadata path, and requires the attacker to hold a role with the edit_course capability, such as Instructor, Instructor's Assistant, LMS Manager, or Administrator.•CVE-2026-104723
  3. LearnPress plugin for WordPress through 4.4.9.1 contains a stored cross-site scripting vulnerability that allows authenticated instructors to inject scripts via quiz question hint and explanation fields. Attackers with the Instructor role can submit unsanitized payloads through the update_question AJAX handler that execute in the session of every student taking the quiz.•CVE-2026-105397
  4. The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Reflected DOM-Based Cross-Site Scripting via the 'orderby' parameter in all versions up to, and including, 4.4.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.•CVE-2026-92538
  5. Authorization Bypass Through User-Controlled Key vulnerability in ThimPress LearnPress allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects LearnPress: from n/a through 4.4.9.•CVE-2026-104403

References

Sources include official advisories and independent security research.