CVE-2026-7566 is a PHP Object Injection vulnerability in the LearnPress – Backup & Migration Tool WordPress plugin affecting all versions up to 4.1.4. The vulnerability arises from unsafe deserialization of untrusted input, allowing authenticated users with administrator privileges to inject PHP objects. However, exploitation requires a gadget POP chain from other plugins or themes to achieve meaningful impact such as arbitrary file deletion, data disclosure, or code execution. No known proof-of-concept exploit chains exist within the plugin itself. The vulnerability has a CVSS 3.1 base score of 6.6, reflecting medium severity with network attack vector, high privileges required, and high impact on confidentiality, integrity, and availability.

An attacker with administrator-level access can exploit this vulnerability only if another plugin or theme installed on the site contains a gadget POP chain. Successful exploitation could lead to arbitrary file deletion, sensitive data disclosure, or remote code execution depending on the available POP chain. Without such a chain, the vulnerability does not pose a direct impact. There are no known exploits in the wild at this time.

No official patch or remediation is currently available for this vulnerability. Since exploitation requires administrator privileges and the presence of a gadget POP chain in other installed components, limiting administrator access and auditing installed plugins/themes for unsafe deserialization gadgets may reduce risk. Monitor the vendor's advisory channels for updates and patches. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.