CVE-2026-104736

Name of the Vulnerable Software and Affected Versions LearnPress versions prior to 4.4.11

Description An unauthenticated attacker can perform PHP Object Injection by sending untrusted input through the checkout-email request parameter during the checkout AJAX action. The input is processed by sanitize text field(), which fails to remove serialized object syntax, and is subsequently stored in the session table. On later requests, the LP Session Handler::get() function passes this data to LP Helper::maybe unserialize() and then to unserialize() without restricting allowed classes, enabling the injection of a PHP Object. PHP Object Injection is a technique where an attacker leverages the deserialization of untrusted data to manipulate the application logic or execute arbitrary code.

Recommendations Update to version 4.4.11 or later. Avoid using the checkout-email parameter in the checkout AJAX action until the update is applied.