WordPress: LearnPress (9.8) and LatePoint (9.1), Two Plugins Exploitable Without an Account — CVE-2026-104736 and CVE-2026-110653

On October 17, 2026, NVD published two critical CVEs in WordPress plugins that are widely used in their category: LearnPress, an online course (LMS) plugin, and LatePoint, an appointment booking plugin.

What they share: neither requires an account on the site. The mechanisms have nothing in common — which is what makes them worth a look.

Scores published by Wordfence (CNA); NVD hasn't analyzed these entries yet. Neither is in CISA KEV at the time of writing. The bounds are "up to and including": NVD gives no fixed version. Check the plugin's page before treating a version as safe.

LearnPress — CVE-2026-104736

Vector: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (9.8)

The checkout-email parameter of the checkout AJAX action is cleaned with sanitize_text_field(), which does not strip serialized PHP object syntax. The value is stored in LearnPress's session table, then read back by LP_Session_Handler::get() and passed to unserialize() without an allowed_classes restriction on subsequent requests.

The result: an anonymous visitor can get a PHP object of their choice deserialized.

What "PHP object injection" implies

On its own, object injection does nothing: it needs a gadget chain ("POP chain") — a class loaded on the site whose magic methods (__destruct, __wakeup…) produce an effect useful to the attacker. NVD's description doesn't mention a chain present in LearnPress itself.

But on a real WordPress site with dozens of plugins loaded, the question isn't whether a chain exists, it's which one. That's why the flaw is rated 9.8: the typical outcome is code execution, file deletion or sensitive data disclosure, depending on what else the site ships.

Exposure: any site where LearnPress checkout is active.

LatePoint — CVE-2026-110653

Vector: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N (9.1)

LatePoint lets customers sign in with a 6-digit OTP code sent by email or SMS, capped at 10 attempts. The attempt counter is incremented from a value read into memory, with no WHERE attempts < 10 guard on the UPDATE and no row lock.

By firing concurrent requests at the auth__verify_otp endpoint, an attacker gets far more than 10 tries before the lockout kicks in, and can brute-force the code. The nonce protecting the endpoint doesn't help: the public request_otp and resend_otp endpoints hand it to anyone.

Condition: knowing the email address or phone number of a registered customer. Impact: full access to that customer's account — bookings and personal data.

It's a good example of a flaw you can't see by reading one function: every line is correct, it's their simultaneous execution that isn't. NVD's references point to the 5.7.4 code and to a file from version 5.7.5; check the plugin changelog to see whether that release fixes it.

Privacy angle: for a practice, clinic or salon, booking data is often sensitive. A customer account takeover is a personal data breach under GDPR and similar laws.

Detection

• LearnPress: abnormal content in the LearnPress session table (strings starting with O: or a: in fields meant to hold an email); recent PHP files in wp-content/; new administrator accounts.
• LatePoint: bursts of requests to auth__verify_otp for the same address within seconds; OTP requests customers didn't make; customer logins from unusual IPs.
• Both: web server access logs filtered on admin-ajax.php, which these actions go through.

For the six critical plugins published the day before, see our October 16 article.

Mitigation

1. Identify affected sites: wp plugin list on each instance.
2. Update past the NVD bounds as soon as a fixed release is out; otherwise deactivate the plugin or, for LatePoint, customer OTP sign-in.
3. LatePoint: rate limiting admin-ajax.php at the web server or WAF sharply narrows the brute-force window.
4. LearnPress: if in doubt, purge the plugin's session table and audit recently modified files.

Why Continuous Monitoring of Your WordPress Plugins Matters

Eight critical plugins in two days, between this article and the previous one. Across a fleet of WordPress sites, the only useful question is "which of my sites runs which of these plugins, in which version".

With cveo.tech, inventory your WordPress plugins with their versions and get an alert as soon as a critical CVE hits them.