Listen to this Post
CVE-2026-104736 represents a severe security flaw affecting the LearnPress plugin.
It is classified as an unauthenticated PHP object injection vulnerability.
The flaw exists in WordPress versions utilizing LearnPress up to version 4.4.10.
Attackers can exploit this issue without requiring any prior authentication.
The entry point for the attack is the checkout AJAX action.
Specifically, the vulnerability targets the checkout-email request parameter.
Untrusted user input is passed directly through this parameter during checkout.
The plugin attempts to sanitize this input using sanitize_text_field().
However, sanitize_text_field() fails to properly strip serialized object syntax.
Consequently, malicious serialized strings bypass the sanitization mechanism entirely.
These malicious strings are subsequently stored inside the LearnPress session table.
On subsequent requests, the session handler retrieves this stored session data.
LP_Session_Handler::get() is invoked to manage session data retrieval operations.
This handler calls LP_Helper::maybe_unserialize() on the stored session values.
The helper function ultimately executes the native PHP unserialize() function.
Crucially, this unserialization process lacks any allowed_classes restriction.
Without class restrictions, arbitrary PHP objects can be safely instantiated.
Attackers leverage magic methods within available application classes.
Common magic methods include __destruct() or __wakeup() routines.
Triggering these methods allows execution of arbitrary code logic.
The overall impact spans complete confidentiality, integrity, and availability compromise.
Because it requires no user interaction, automated exploitation is trivial.
The attack vector remains fully network-accessible over standard HTTP protocols.
Security researchers discovered this flaw through static and dynamic code analysis.
Public repositories and vulnerability databases quickly cataloged the incident.
Vendors and maintainers were notified to issue emergency security updates.
Web administrators must immediately audit their WordPress plugin installations.
Implementing strict web application firewall rules can temporarily mitigate risks.
Complete remediation requires updating LearnPress beyond the affected version.
Understanding this mechanism is vital for effective defensive posture hardening.
DailyCVE Form:
Platform: WordPress LearnPress
Version: Up to 4.4.10
Vulnerability: PHP Object Injection
Severity: Critical
date: October 2026
Prediction: October 2026
What Undercode Say
wp plugin update learnpress grep -rn "maybe_unserialize" wp-content/plugins/learnpress/ mysql -u root -p wordpress -e "SELECT FROM wp_learnpress_sessions;"
Exploit: (Educational Purposes!)
<?php
class ExploitPayload {
public $param = 'malicious_code_execution';
}
echo serialize(new ExploitPayload());
?>
Protection
Update LearnPress plugin to a version newer than 4.4.10.
Block unauthenticated checkout AJAX requests via WAF.
Enforce strict validation on checkout-email parameters.
Impact
Complete remote code execution on the server.
Total loss of data confidentiality and integrity.
Full system compromise via unauthenticated network vector.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
