LearnPress CVE-2026-104736

No special configuration is required: the vulnerable path is the default LearnPress checkout AJAX action, reachable by unauthenticated users via the 'checkout-email' request parameter, so any site running LearnPress ≤4.4.10 with standard checkout enabled is exposed. The payload is stored in the LearnPress session table and deserialized by LP_Session_Handler::get() via LP_Helper::maybe_unserialize() → unserialize() with no allowed_classes restriction on a subsequent request. The key LIMITING factor is that object injection alone is inert - achieving the claimed high confidentiality/integrity/availability impact (e.g., RCE) requires a usable POP gadget chain in LearnPress, WordPress core, or another installed plugin/theme; without such a chain, practical impact is reduced.

All provided signals point to a genuinely high-priority flaw, with important caveats on real-world impact. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) is internally consistent with the description: exploitation is network-based, low-complexity, and unauthenticated, reaching the public checkout AJAX action - nothing contradicts the 9.8 score. However, CWE-502 PHP Object Injection is a conditional-impact class: injecting a PHP object only yields the claimed C:H/I:H/A:H (typically RCE, file ops, or data exfiltration) if a usable POP gadget chain exists in LearnPress, WordPress core, or a co-installed plugin/theme. The 9.8 therefore reflects worst-case potential rather than guaranteed universal RCE. EPSS is NOT provided in the input, so exploitation probability cannot be quantified. KEV status is absent (not listed), and no POC/exploit code is referenced - this is credited to Wordfence research only. SSVC fields (automatable, technical impact, exploitation) were not supplied. Net: treat as a priority patch given unauthenticated network reachability and the historical prevalence of working WordPress POP chains, but note that active exploitation is NOT confirmed and the raw 9.8 may overstate guaranteed impact absent a gadget chain.

An unauthenticated attacker submits a crafted 'checkout-email' value containing serialized PHP object syntax to the LearnPress checkout AJAX endpoint. sanitize_text_field() leaves the serialized payload intact, so it is stored in the LearnPress session table and later passed to unserialize() without allowed_classes restriction on a subsequent request, instantiating an attacker-controlled object. If a suitable POP gadget chain is present in the stack, this escalates to remote code execution or data compromise; no public exploit code is referenced at time of analysis.