PHP Object Injection Vulnerability in LearnPress Plugin for WordPress

CVE-2026-104736

What is CVE-2026-104736?

The LearnPress plugin for WordPress is susceptible to PHP Object Injection due to the improper handling of deserialized data from untrusted user input during the checkout process. Specifically, when the 'checkout-email' request parameter is processed, it goes through the sanitize_text_field() function, which fails to eliminate serialized object syntax before being stored in the LearnPress session. This data is later unserialized without stringent checks for allowed classes in LP_Helper::maybe_unserialize(), granting unauthenticated attackers the potential to inject malicious PHP objects into the application.

References