PHP Object Injection Vulnerability in LearnPress Backup & Migration Tool for WordPress

CVE-2026-7566

What is CVE-2026-7566?

The LearnPress – Backup & Migration Tool plugin for WordPress is susceptible to PHP Object Injection, allowing authenticated users with administrator access to exploit the vulnerability through the deserialization of untrusted input. While no known PHP Object Pattern (POP) chain exists in the current software, the vulnerability poses a risk if additional plugins or themes containing a POP chain are present. An attacker could potentially leverage this vulnerability to delete arbitrary files, retrieve sensitive information, or execute malicious code, depending on the specific configuration of the site.

References