CVE-2026-104736: CWE-502 Deserialization of Untrusted Data in thimpress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses

The LearnPress plugin for WordPress, up to and including version 4.4.10, is affected by a PHP Object Injection vulnerability (CWE-502) due to unsafe deserialization of untrusted input. Specifically, the 'checkout-email' request parameter is sanitized using sanitize_text_field(), which does not remove serialized object syntax. This data is stored in the LearnPress session table and later unserialized by LP_Helper::maybe_unserialize() and LP_Session_Handler::get() without restricting allowed classes. This flaw enables unauthenticated attackers to inject arbitrary PHP objects, potentially leading to full system compromise.

Successful exploitation allows unauthenticated attackers to perform PHP Object Injection, which can lead to remote code execution, complete compromise of the WordPress site, and full control over the affected system. The CVSS 3.1 score of 9.8 reflects the critical impact on confidentiality, integrity, and availability.

No official patch or fix is currently documented. Users should monitor the vendor's advisory for updates. Until a fix is available, consider disabling or restricting access to the vulnerable AJAX checkout functionality or applying custom code to prevent unserialization of untrusted data. Avoid using affected versions in production environments where possible.