WP LearnPress v4.4.10 Faces Critical 9.8 CVSS Risk via Unauthenticated PHP Object Injection

Unauthenticated attackers can now inject malicious PHP objects into websites using the LearnPress plugin for WordPress. This capability stems from a flaw in how the plugin handles user input during the checkout process. According to the National Vulnerability Database, the issue exists in versions up to 4.4.10. The flaw allows an attacker to bypass authentication entirely. They can manipulate the 'checkout-email' request parameter to introduce harmful data. This data is then processed by the plugin’s internal functions. The result is a critical security breach that compromises the integrity of the site.

In plain English

The LearnPress plugin is designed to help creators sell online courses. It includes a checkout feature where users enter their details. A flaw in this feature allows outsiders to send hidden, malicious instructions along with their email address. The plugin accepts this input without properly checking for dangerous code. It stores this untrusted data in its session table. Later, when the system retrieves this data, it treats the hidden instructions as legitimate commands. This allows the attacker to inject a PHP Object into the system.

The background

The vulnerability was identified and recorded as CVE-2026-104736. The National Vulnerability Database assigned it a CVSS score of 9.8, classifying it as Critical. The underlying weakness is categorized as CWE-502, which refers to deserialization of untrusted data. This means the application converts data back into an object format without verifying its safety. The affected product is the LearnPress WordPress LMS Plugin, developed by ThimPress. All versions up to 4.4.10 are vulnerable to this specific injection technique.

What changes now

Site administrators using LearnPress must assess their exposure to this flaw. Since the vulnerability allows unauthenticated access, any public-facing checkout page is a potential entry point. Teams should verify their current plugin version immediately. If they are running version 4.4.10 or earlier, they are at risk. There is no confirmed patch mentioned in the source material yet. Users must monitor vendor announcements for an update. Until a fix is available, limiting access to checkout features may be necessary.

What made it possible

Deserialization flaws occur when applications convert external data into executable objects without strict validation. This technique allows attackers to bypass standard input filters if those filters do not recognize serialized syntax. In intrusion scenarios, this serves as an initial access vector, granting remote code execution without credentials. Teams usually check whether applications validate data types before processing. They should ensure that deserialization functions restrict allowed classes. Monitoring for unexpected object creation helps detect these attempts early.

What to do and how to stay safe: LearnPress

• Check your WordPress dashboard to confirm the installed version of the LearnPress plugin.
• Monitor vendor communications for an official security update or patch release.
• Consider restricting access to checkout pages if you cannot update immediately.
• Review server logs for unusual activity related to the checkout AJAX action.

Step-by-step guide: Automatic Updates Mistakes That Leave Systems Exposed

General security guidance from the RedTeam Monitor newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which versions of LearnPress are affected by this vulnerability?

All versions up to and including 4.4.10 are vulnerable to this PHP Object Injection flaw.

Is authentication required to exploit this vulnerability?

No, the vulnerability allows unauthenticated attackers to inject malicious objects.

What is the CVSS score for CVE-2026-104736?

The NVD rates this vulnerability as Critical with a CVSS score of 9.8.