Summary
generated automatically from NVD dataThe LearnPress plugin for WordPress, in versions up to and including 4.4.10, is affected by a PHP Object Injection flaw (CWE-502). The 'checkout-email' parameter of the checkout AJAX action is only filtered with sanitize_text_field(), saved in the session table, and later passed to unserialize() without an allowed_classes restriction by LP_Session_Handler::get(). Unauthenticated attackers can thereby inject a PHP object, and the flaw is rated CVSS 9.8 (CRITICAL).
NVD description
The LearnPress plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 4.4.10 via deserialization of untrusted input from the 'checkout-email' request parameter during the checkout AJAX action. The value is passed through sanitize_text_field(), which does not strip serialized object syntax, then stored in the LearnPress session table and later fed to LP_Helper::maybe_unserialize() → unserialize() (without an allowed_classes restriction) by LP_Session_Handler::get() on subsequent requests. This makes it possible for unauthenticated attackers to inject a PHP Object.
EPSS · FIRST.org
0.44%probability of exploitation in the next 30 days
Higher than 36% of scored CVEs
EPSS (Exploit Prediction Scoring System) estimates, from observed exploitation activity, how likely a CVE is to be exploited in the next 30 days. It complements CVSS, which measures severity, not likelihood. Score of 2026-10-18, recomputed daily by FIRST.org.
In-depth analysis on cveo.tech
We've published a detailed analysis of this CVE — exploitation, IOCs and mitigation.
CVSS v3.1 Score
Information
- Published
- 17 oct. 2026
- Updated
- 18 oct. 2026
- Status
- Received
- Source
- security@wordfence.com
Weaknesses (CWE)
References (6)
Similar CVEs
Other vulnerabilities of type CWE-502
Monitor your products
Get automatic alerts for every new CVE affecting your equipment.