Unauthenticated PHP object injection in the LearnPress WordPress LMS plugin through version 4.4.10 allows attackers to store a crafted serialized object via the checkout-email parameter, which LearnPress later deserializes without an allowed_classes restriction. The CVSS 3.1 score is 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), but practical high-impact exploitation depends on a usable POP gadget chain in LearnPress, WordPress core, or another installed plugin/theme; no public exploit has been identified at time of analysis.
phpMyFAQ 4.0.0 through 4.1.8 allows unauthenticated remote attackers to take over arbitrary user accounts through its WebAuthn/passkey registration flow. The registration endpoint attaches a new passkey to a staged username without requiring an existing session or validating the WebAuthn challenge, so a forged fmt=none attestation can register an attacker-controlled credential; subsequent passkey login bypasses password and TOTP checks. No public exploit code was identified at time of analysis, and affected instances should be upgraded to 4.1.9 or later.
LatePoint WordPress plugin through 5.7.4 allows unauthenticated remote attackers who know a target customer's registered email address or phone number to bypass OTP authentication by racing the attempts counter and brute-forcing the 6-digit code, potentially taking over that customer's account, bookings, and personal data. Exploitation requires the site to use LatePoint's OTP/passwordless login flow and the attacker to win a concurrency race while guessing the code; no public exploit identified at time of analysis.