External risk intelligence

LearnPress PHP Object Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-104736

The vulnerability exists in the LearnPress plugin for WordPress, specifically within the checkout process. This functionality is designed to be public-facing and reachable by unauthenticated users as part of the normal e-commerce operation of a website.

Deserialization

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in the widely used LearnPress WordPress plugin, affecting its checkout functionality. This flaw allows unauthenticated attackers to inject malicious code through improperly handled input, potentially leading to a compromise of the website's integrity. While the exact business impact is not detailed, the severity and exposure suggest a need to confirm relevance and any potential impact.

Unauthenticated code injection in WordPress plugin.
Critical flaw impacts customer checkout process.
Confirm relevance and potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by sending a specially crafted request to a WordPress site that uses the affected LearnPress plugin. The request targets an AJAX action within the checkout process, and by manipulating the 'checkout-email' parameter with serialized data, the attacker can trigger the plugin to improperly deserialize this data. This leads to the injection of a PHP object, potentially allowing the attacker to execute arbitrary code on the server.

No authentication required.
Triggered via checkout AJAX request parameter.
Allows PHP object injection.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow unauthenticated attackers to inject PHP objects into a WordPress site running the LearnPress plugin. This injection occurs during the checkout process when specific input is not properly sanitized before being unserialized, potentially affecting site functionality and security when the plugin is used.

Sensitive system data and user data.
Via deserialization of untrusted input.
Compromise of site integrity and functionality.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability in the LearnPress WordPress plugin affects unauthenticated users and could allow for PHP Object Injection. The first step is to identify all WordPress sites using LearnPress, determine their exposure and criticality, and locate the accountable owner, likely within application or platform teams. Remediation planning should prioritize high-risk assets.

Identify affected WordPress installations and owners.
Verify public accessibility and business criticality.
Plan remediation based on assessed risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the LearnPress plugin?

LearnPress is a comprehensive Learning Management System (LMS) plugin for WordPress. It is used by site administrators to build and manage online courses, providing features such as course curriculum creation, student management, and payment processing for e-commerce transactions within the WordPress ecosystem.

What is the PHP Object Injection weakness in CVE-2026-104736?

This vulnerability, classified as CWE-502, occurs when an application takes untrusted data and uses it to create an object without proper validation. In this CVE, the plugin accepts serialized data from a user, fails to restrict what kind of objects can be created, and then processes that data. This allows an attacker to inject custom PHP objects, which can manipulate the site's logic or lead to the execution of unintended code.

How is this vulnerability triggered?

The flaw is triggered during the checkout process when the plugin processes an AJAX request. An attacker sends a specially crafted payload within the 'checkout-email' parameter. It is important to note that simply visiting a course page does not trigger the bug; the malicious input must be specifically submitted through the vulnerable checkout AJAX action to be stored and subsequently processed by the server.

Why should I be concerned about this vulnerability?

You should care because Halo Surface Signal indicates this vulnerability resides in the checkout process, which is designed to be public-facing. Since it allows unauthenticated users to inject objects, any WordPress site using LearnPress that is accessible over the internet is exposed to this risk. If your site handles commerce or sensitive student data, an attacker could potentially exploit this to compromise the integrity of your environment.

What steps should I take to respond?

Begin by auditing your WordPress environment to identify if LearnPress is installed and which versions are currently active. Once identified, locate the technical owners responsible for these sites to coordinate an assessment of their public accessibility. Prioritize your response based on the criticality of the site, ensuring that any vulnerable installations are addressed through updates or mitigation strategies before they can be leveraged.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.