LearnPress CVE-2026-104736: critical PHP object injection

What it is and who is affectedThe LearnPress plugin for WordPress carries a critical vulnerability tracked as CVE-2026-104736. The National Vulnerabil...

What it is and who is affected

The LearnPress plugin for WordPress carries a critical vulnerability tracked as CVE-2026-104736. The National Vulnerability Database (NVD) of NIST describes it as a PHP object injection flaw (CWE-502) that affects all versions up to and including 4.4.10.

The weak point sits in the checkout flow. When the checkout AJAX action runs, the value sent in the checkout-email request parameter is passed through sanitize_text_field(), which does not strip serialised object syntax. That value is then stored in the LearnPress session table and later handed to LP_Helper::maybe_unserialize() and finally to unserialize() without an allowed_classes restriction, triggered by LP_Session_Handler::get() on later requests. The practical consequence is that an unauthenticated attacker can inject a PHP object.

NVD rates it CVSS 3.1: 9.8, critical (vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The low attack complexity, the lack of privileges required and the absence of user interaction explain the score. It was published on 17 October 2026.

In practice, this concerns any organisation in Spain or Catalonia running an online training portal, a course catalogue or a members' area on WordPress with LearnPress installed: academies in Barcelona, corporate training sites in Lleida, subscription-based learning businesses in Tarragona or Girona, and ecommerce sites that added a course section. If the plugin is active and reachable from the internet, the exposure is real.

Why it matters, and why it is not a five-alarm fire

At the time of writing, CVE-2026-104736 does not appear in CISA's KEV catalogue, so there is no public record that it is being exploited in real attacks. That is good news, but it should not be read as a reason to wait. A critical object injection on an unauthenticated endpoint is exactly the kind of flaw that gets picked up by automated scanners within days of publication, and the affected code path is part of the normal checkout, not an obscure admin screen.

PHP object injection matters because the injected object can trigger magic methods in other loaded classes. Depending on which plugins and libraries are installed alongside LearnPress, that can open the door to data exposure, file operations or remote code execution. The NVD vector already reflects high confidentiality and integrity impact, and the outcome depends heavily on what else is loaded on the site. On a small business site with a handful of plugins, that combination is rarely reassuring.

What to do today

Check whether LearnPress is installed and in which version. In the WordPress dashboard, go to the plugins list and read the version next to LearnPress. Anything at or below 4.4.10 is in scope. If you manage several sites, run the check across all of them, including staging copies that are publicly reachable.
Update as indicated by the vendor's advisory. The material available does not specify a fixed version, so follow the instructions in the official LearnPress advisory and the plugin's changelog rather than guessing. If no fix is available yet, apply the mitigations the vendor recommends and consider deactivating the plugin until one lands.
Look for signs of intrusion. Review web server logs for unusual POST requests to the checkout AJAX endpoint, unfamiliar entries in the LearnPress session table, unexpected files in the uploads directory, new administrator accounts and unexplained changes to plugin or theme files. Keep in mind that a successful injection may leave very little trace in the application itself.
Reduce what is exposed to the internet. Restrict access to the checkout endpoint where the business allows it, keep a web application firewall in front of the site, and make sure the WordPress admin area is not openly reachable from anywhere. Remove plugins and themes that are not in use.
Keep the rest of the stack current. A single outdated plugin is a symptom; the same discipline applied to WordPress core, themes and every other extension is what actually lowers risk.

How a cybersecurity team such as ALMC's can help

Cases like this one are rarely solved by a single update. They require knowing which sites run which plugins at which version, and having a process that reacts when a critical advisory appears. At ALMC we work with SMEs, online shops and small IT teams across Catalonia on exactly that: security audits and pentesting to find weaknesses before they are exploited, server hardening, monitoring and incident response, and maintenance and updating of WordPress, PrestaShop and Joomla installations.

When a site has already been compromised, we also handle the repair of hacked websites: identifying the entry point, cleaning the installation, closing the gap and restoring normal operation under GDPR-compliant practices. For a business whose training portal or shop depends on WordPress, having that support in place turns a critical CVE from an emergency into a task with an owner and a deadline.

Is your business exposed to flaws like this?

ALMC checks which versions you are running, applies the patches and hardens your servers and website. Contact our team for a security review.

Results without leaving the page.