CVE-2026-7566

Name of the Vulnerable Software and Affected Versions LearnPress – Backup & Migration Tool versions prior to 4.1.5

Description The plugin is susceptible to PHP Object Injection due to the deserialization of untrusted input. This allows authenticated attackers with administrator-level access or higher to inject a PHP Object. The impact depends on the presence of a POP chain (a sequence of gadgets used to achieve a specific goal during deserialization) within other installed plugins or themes. If such a chain exists, an attacker could potentially delete arbitrary files, retrieve sensitive data, or execute code.

Recommendations Update to a version later than 4.1.4.