CVE-2026-104736

Executive Summary

CVE-2026-104736 is a critical PHP Object Injection vulnerability in the LearnPress WordPress plugin (a widely deployed learning management system), affecting versions up to and including 4.4.10. The flaw is reachable without authentication: attacker-controlled input submitted through the checkout-email request parameter during the checkout AJAX action is inadequately sanitized, persisted in the LearnPress session table, and later deserialized via LP_Helper::maybe_unserialize() without an allowed_classes restriction. With a CVSS base score of 9.8, successful exploitation can lead to full compromise of confidentiality, integrity, and availability of the WordPress site and its hosting environment, depending on available gadget chains.

Technical Analysis

The vulnerability class is PHP Object Injection (CWE-502, Deserialization of Untrusted Data). LearnPress processes a checkout AJAX request that carries a checkout-email parameter. This value is passed through WordPress's sanitize_text_field(), which is designed to strip markup and invalid UTF-8 but does not remove serialized object syntax (e.g., O:<len>:"ClassName":...). Because the sanitization is semantically wrong for the data being handled, a serialized object payload survives intact.

The tainted string is then written into the LearnPress session table. On subsequent requests, LP_Session_Handler::get() retrieves the stored session value and passes it into LP_Helper::maybe_unserialize(), which ultimately calls PHP's native unserialize() without the allowed_classes restriction. The absence of a class allow-list is the core defect: it permits instantiation of arbitrary classes defined by the WordPress core, other installed plugins/themes, or LearnPress itself.

The direct consequence is object injection — the attacker controls which classes are instantiated and with which properties (via magic methods such as __wakeup, __destruct, __toString). Whether object injection escalates to remote code execution, file deletion, SQL injection, or SSRF depends entirely on the population of gadget chains present in the target's installed code base. The NVD description confirms the injection primitive; it does not enumerate a specific final-impact gadget chain. No public proof-of-concept or exploit code is currently available, so the exact chain is inferred from the vulnerability class.

Exploitation Scenarios

No public PoC is available; the chain below is inferred from the vulnerability class and the disclosed data flow.

1. Reconnaissance / target identification. An attacker enumerates internet-facing WordPress sites running LearnPress at or below 4.4.10, identifiable via the plugin's static asset paths and its checkout functionality. No credentials are required (PR:N), and no user interaction is needed (UI:N), so any exposed storefront with the checkout flow enabled is a candidate.

2. Triggering the flaw. The attacker submits a checkout AJAX request containing a crafted checkout-email value carrying serialized-object syntax. Because sanitize_text_field() does not strip that syntax, the payload is accepted and stored in the LearnPress session table — a persistent injection, meaning the malicious value survives the request.

3. Payload / execution method. On a subsequent request, LP_Session_Handler::get() reads the stored session and invokes LP_Helper::maybe_unserialize() → unserialize() with no allowed_classes restriction. The attacker's serialized object is instantiated. The exact post-instantiation behavior depends on which classes and magic methods exist on the target — the attacker selects gadget classes accordingly (at the vulnerability-class level, this is a classic POP/gadget-chain construction). This is not a one-shot injection; the persistence in the session table allows retries and payload iteration.

4. Post-exploitation impact. Given CVSS C:H/I:H/A:H, a successful gadget chain could yield code execution, arbitrary file operations, or database manipulation on the WordPress host — full site compromise. Even without a completed gadget chain, the unauthenticated object-injection primitive and stored-payload persistence represent a high-severity exposure on e-commerce/learning platforms that typically handle user PII and payment-adjacent data.

Impact Assessment

CVSS 3.1 base score 9.8 (Critical): AV:N (network reachable), AC:L (no special conditions), PR:N (unauthenticated), UI:N (no interaction), S:U (impact scoped to the vulnerable component), C:H/I:H/A:H (total loss of confidentiality, integrity, and availability if a gadget chain is completed). The blast radius is any WordPress installation running LearnPress ≤ 4.4.10 with checkout enabled. Because the injected payload is persisted in the session table, compromise is not transient: a stored malicious session object remains a live trigger until cleaned, raising the risk of repeated or staged attacks. Business impact includes potential site takeover, data exfiltration (student/customer records), defacement, and use of the host as a pivot point. The CVSS is capped at S:U; real-world impact could exceed the stated scope if a gadget chain reaches the underlying OS.

Detection Guidance

Sigma Rule

title: LearnPress CVE-2026-104736 PHP Object Injection via checkout-email
id: 7f3a2c91-learnpress-objinj
status: experimental
description: Detects serialized-object syntax submitted in checkout-email parameter to LearnPress checkout AJAX action
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-104736
author: valtersit.com
logsource:
  category: webserver
detection:
  selection_uri:
    cs-uri-query|contains:
      - 'checkout-email'
      - 'lp-checkout'
      - 'admin-ajax.php'
  selection_payload:
    cs-uri-query|contains:
      - 'O:%d+:"'
      - 'O:4:"'
      - 'a:%d+:{'
  condition: selection_uri and selection_payload
fields:
  - c-ip
  - cs-uri-query
  - cs-method
falsepositives:
  - Legitimate serialized strings in rare custom integrations
level: critical

YARA Rule

rule CVE_2026_104736_LearnPress_ObjectInjection
{
    meta:
        description = "Detects serialized PHP object payloads targeting LearnPress checkout-email (CVE-2026-104736)"
        reference   = "https://nvd.nist.gov/vuln/detail/CVE-2026-104736"
        cve         = "CVE-2026-104736"
        author      = "valtersit.com"
        severity    = "critical"
    strings:
        $p1 = "checkout-email"
        $ser1 = /O:[0-9]{1,4}:"[A-Za-z0-9_\\]{1,120}":/
        $ser2 = /a:[0-9]{1,4}:\{/
        $magic1 = "__wakeup"
        $magic2 = "__destruct"
    condition:
        $p1 and $ser1 and 1 of ($magic1, $magic2)
        or ($p1 and $ser1 and #ser2 > 0)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-104736 LearnPress PHP Object Injection (checkout-email)"; flow:to_server,established; content:"checkout-email"; http_uri; nocase; pcre:"/O:\d+:\"[^\"]+\"/Ui"; pcre:"/__wakeup|__destruct/"; classtype:web-application-attack; reference:cve,2026-104736; sid:2026104736; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=10m
  [network where url.query : ("*checkout-email*" and ("*O:*\"*" or "*a:*{*"))]
  [network where url.path : "*admin-ajax.php" and url.query : "*action=*checkout*"]

Splunk SPL Query

index=web sourcetype=access_combined
| eval q=urldecode(uri_query)
| search q="*checkout-email*"
| where match(q, "O:[0-9]+:\"[^\"]+\"") OR match(q, "a:[0-9]+:\{")
| stats count min(_time) as first_seen max(_time) as last_seen values(clientip) as src_ips by host, q
| sort - count

Wazuh OSSEC Rule

<group name="web,attack,">
  <rule id="2026104" level="12">
    <if_sid>31100</if_sid>
    <match>checkout-email</match>
    <regex>O:\d+:"|a:\d+:\{</regex>
    <description>CVE-2026-104736 LearnPress PHP Object Injection attempt via checkout-email</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No authoritative vendor fix is confirmed in the tracked sources; no workarounds are published.

1. Immediate mitigations. Because the flaw is unauthenticated and reachable via the checkout flow, restrict exposure immediately: place the WordPress admin-ajax/checkout endpoint behind WAF rules matching serialized-object syntax in query/body parameters; block or challenge unauthenticated POSTs to the checkout AJAX action at the edge; and monitor/clean the LearnPress session table for stored serialized-object payloads. Disabling the LearnPress checkout feature (if operationally possible) reduces the attack surface until a fix exists.
2. Patch / upgrade steps. Track the LearnPress project and WordPress plugin repository for a release that addresses CVE-2026-104736 (a version above 4.4.10). Do not assume any specific version is fixed unless confirmed by the vendor. Apply updates to WP core, plugins, and themes promptly once available — the object-injection primitive also depends on the availability of gadget chains elsewhere in the code base, so removing out-of-date plugins reduces exploitability.
3. Long-term hardening. Enforce least privilege on the web server user; deploy a WAF tuned to CWE-502 patterns; adopt a WordPress plugin inventory/allow-list policy; monitor the session table and error logs; and prioritize upgrades in any LearnPress deployment handling student or payment data. Prefer environments where PHP unserialize usage is replaced by unserialize($data, ['allowed_classes' => false]) in custom code you control.

References

• NVD — CVE-2026-104736: https://nvd.nist.gov/vuln/detail/CVE-2026-104736
• MITRE CWE-502 (Deserialization of Untrusted Data): https://cwe.mitre.org/data/definitions/502.html
• MITRE ATT&CK T1190 (Exploit Public-Facing Application): https://attack.mitre.org/techniques/T1190/
• LearnPress project / WordPress plugin repository (patch tracking): https://wordpress.org/plugins/learnpress/
• EPSS score: not yet assigned by FIRST.org at time of writing; PoC/Exploit: None; CISA KEV: NO (no confirmed in-the-wild exploitation evidence located).