CVE-2026-104736 — LearnPress ≤4.4.10 Unauthenticated PHP Object Injection (checkout-email)

October 18, 2026 · 338 views

LearnPress WordPress LMS ≤4.4.10: guest lp-ajax=checkout stores checkout-email in LP session → maybe_unserialize on read (CWE-502). POP/RCE if gadgets exist. Fixed 4.4.11. Python PoC: check, exploit, course discovery, CHAINS.md. CVSS 9.8 Critical unauth.

#wordpress#learnpress#lms#plugin#deserialization#php-object-injection#pop#unauthenticated#cwe-502#critical

CVE:

CVE-2026-104736

Date:

2026-10-18

Severity:

CRITICAL

Exploit source

Full PoC repository on GitHub (public).

Description

Overview

CVE-2026-104736 — LearnPress WordPress LMS plugin — unauthenticated PHP object injection via guest checkout AJAX (CWE-502).

| | | |---|---| | Affected | ≤ 4.4.10 | | Fixed | 4.4.11+ | | CVSS | 9.8 Critical | | Auth | None (guest checkout:nopriv) | | Vector | lp-ajax=checkout, parameter checkout-email |

LearnPress uses lp-ajax (not only admin-ajax.php?action=). Vulnerable builds call session->set('checkout-email', ...) from the request, then LP_Helper::maybe_unserialize() on session read — attacker-controlled serialized objects → POP (RCE when suitable gadgets exist).

PoC page: https://pocbit.org/pocs/cve-2026-104736

GitHub: murrez/CVE-2026-104736

CVE.org: CVE-2026-104736

Note: 4.4.10 may sanitize_email on checkout-email, which can strip raw serialized blobs — confirm in lab (session DB / probe). See CHAINS.md in bundle for phpggc / chain notes.

Bundled tool (Python 3.10+)

Download cve-2026-104736.py — writes poc.py, learnpress_core.py, CHAINS.md, tests/.

python cve-2026-104736.py
pip install -r requirements.txt

python poc.py --mode check -u https://lab.local
python poc.py -u https://lab.local
python poc.py -f targets.example.txt --mode check -j 20
python -m unittest discover -s tests -t . -v

Modes: check (readme/version fingerprint), exploit (course discovery, cart prep, multi-URL inject, session trigger). Harmless stdClass probe documented in README.

Mitigation

Upgrade LearnPress to ≥ 4.4.11.
WAF: monitor lp-ajax=checkout POSTs with serialized patterns in checkout-email.
Reduce plugin attack surface; audit other LMS/checkout plugins similarly.

Legal and ethical use

Authorized security research and patch validation only.