CVE-2026-104736learnpress Insecure Deserialization
LearnPress <= 4.4.10 - Unauthenticated PHP Object Injection via 'checkout-email' Parameter
Published Oct 16, 2026 · Updated Oct 18, 2026 · Also known as 3e28e008-0ec1-4262-9ac0-6170cf8b8bdf, EUVD-2026-103224, GHSA-xchc-mccm-x286, WORDFENCE-3e28e008-0ec1-4262-9ac0-6170cf8b8bdf
Key Facts
Patch immediately- CVE-2026-104736 is a critical-severity vulnerability (CVSS 9.8 v3.1) affecting learnpress (wordpress-plugin), LearnPress – WordPress LMS Plugin for Create and Sell Online Courses.
- It is exploited in the wild, listed in Industry KEV feed since Oct 16, 2026. No public exploit code is known.
- EPSS estimates a 0.4% probability of exploitation in the next 30 days.
- Fixed versions are available, including learnpress 4.4.11.
- Brandefense priority: patch immediately, because it is listed as exploited in the wild.
Scores
CVSS v3.1
9.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS (30-day exploit likelihood)
0.4%
Exploit maturity
Proof of concept
ATLAS score
44/100
Publication score, see How it works
Exploitation Verdict
KEV listed
Oct 16, 2026
Federal due date
None
No federal due date
Ransomware use
Not reported
Attributed actors
None named
Exploit & Defence Guidance
Exploit maturity
Proof of concept
Public exploit code
2
Proof-of-concept links
In-the-wild evidence
1
Reports of active use
Advisories And Exploit References
Description
The LearnPress plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 4.4.10 via deserialization of untrusted input from the 'checkout-email' request parameter during the checkout AJAX action. The value is passed through sanitize_text_field(), which does not strip serialized object syntax, then stored in the LearnPress session table and later fed to LP_Helper::maybe_unserialize() → unserialize() (without an allowed_classes restriction) by LP_Session_Handler::get() on subsequent requests.
This makes it possible for unauthenticated attackers to inject a PHP Object.
Known-Exploited Catalog Listings
| Catalog | Added | Remediation due | Ransomware use |
|---|---|---|---|
| Industry KEV feed | Oct 16, 2026 | n/a | Not reported |
Affected Products
3 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| learnpresswordpress-plugin | See advisory | 4.4.11 |
| LearnPress – WordPress LMS Plugin for Create and Sell Online Courses | See advisory | n/a |
Patched Releases
learnpress
4.4.11
Timeline
Publicly disclosed
Oct 16, 2026
Added to Industry KEV feed
Oct 16, 2026
Last updated
Oct 18, 2026
Weakness Type
- CWE-502 Deserialization of Untrusted Data
References
- advisorywordfence.com · 3e28e008-0ec1-4262-9ac0-6170cf8b8bdf
- exploitVulnCheck exploitation report
- otherplugins.trac.wordpress.org · class-lp-ajax.php
- otherplugins.trac.wordpress.org · class-lp-checkout.php
- otherplugins.trac.wordpress.org · class-lp-checkout.php
FAQ
Common Questions.
The LearnPress plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 4.4.10 via deserialization of untrusted input from the 'checkout-email' request parameter during the checkout AJAX action.
Affected: learnpress (wordpress-plugin); LearnPress – WordPress LMS Plugin for Create and Sell Online Courses. The full list is in the CVE brief.
It is exploited in the wild, listed in Industry KEV feed since Oct 16, 2026.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
No public exploit code is known.
Fixed versions are available, including learnpress 4.4.11.
Brandefense priority: patch immediately, because it is listed as exploited in the wild.
Is CVE-2026-104736 On Your Attack Surface?
Brandefense matches it against the products discovered on your perimeter and opens a finding the day a CVE like this is listed.
Request A Demo