CVE-2026-109208

Executive Summary

CVE-2026-109208 is a stored cross-site scripting (XSS) vulnerability in the LearnPress WordPress LMS plugin affecting all versions up to and including 4.4.10. The flaw stems from insufficient input sanitization and output escaping of the quantity (REST) and order_comments (checkout) parameters, allowing attackers to inject arbitrary web scripts that execute when a victim accesses an injected page. With guest checkout enabled, the attack is fully unauthenticated (CVSS 7.2, PR:N); with guest checkout disabled, any Subscriber-level user can exploit both vectors. No public proof-of-concept or patch currently exists, making this a live exposure for unpatched LearnPress deployments.

Technical Analysis

CVE-2026-109208 is a persistent (stored) cross-site scripting vulnerability classified under CWE-79 (Improper Neutralization of Input During Web Page Generation). The vulnerability resides in the LearnPress plugin's handling of two distinct input vectors:

1. quantity parameter (REST interface) — submitted through a REST API endpoint associated with order/cart handling.
2. order_comments parameter (checkout flow) — captured during the customer checkout process.

In both cases, the NVD description states that insufficient input sanitization and output escaping allow arbitrary web scripts to be stored and later reflected to users. Because the payload is persisted (stored) rather than reflected, execution occurs whenever any user — including administrative users viewing orders or dashboards — accesses the injected page.

The attack surface is the WordPress front-end checkout and the plugin's REST handling. The critical access-control weakness is that the payload injection does not require authenticated privilege when guest checkout is enabled, yielding an unauthenticated attack path (PR:N). When guest checkout is disabled, the flaw is still reachable by any Subscriber-level account, which lowers the bar dramatically compared to administrator-level requirements.

The CVSS vector AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N indicates:

• AV:N — remotely exploitable over the network.
• AC:L — no special conditions or race required.
• PR:N — no privileges required (guest checkout scenario).
• UI:N — no victim interaction beyond visiting an injected page is required for the attack to be staged.
• S:C — scope change: the injected script executes in the context of the WordPress site but can affect components beyond the vulnerable component (e.g., admin session, other plugins, cookies).
• C:L / I:L — limited confidentiality and integrity impact (typical of stored XSS where session tokens or admin actions can be hijacked).
• A:N — no direct availability impact.

Because no public exploit code, Nuclei template, or CVE assignment metadata from the CNA was provided, the exact endpoint paths, HTTP methods, and parameter parsing routines are not documented in available intelligence. The precise sanitization function that fails is also unspecified. Analysts should treat the vulnerability at the class level: attacker-controlled strings enter storage through checkout/REST parameters and are later emitted into HTML without proper encoding.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the stored XSS vulnerability class and the CNA description.

1) Reconnaissance / target identification. An attacker fingerprints WordPress sites running LearnPress by requesting paths under /wp-content/plugins/learnpress/ or inspecting front-end HTML for LearnPress-specific markup and asset references. Sites with guest checkout visible (order forms accessible without login) are prioritized.

2) Triggering the flaw. The attacker submits a checkout or REST request carrying a malicious payload in either the quantity or order_comments parameter. With guest checkout enabled, no authentication is needed; otherwise the attacker registers a Subscriber-level account and submits the payload through their own checkout flow.

3) Payload / execution. The payload is a script-bearing string that survives storage because sanitization is insufficient on input and escaping is insufficient on output. The exact HTML/JS context is not documented in available data, but standard stored-XSS payloads (event handlers, <script> blocks, or encoded variants) are the class-level mechanism. The script executes when a victim — potentially an administrator reviewing the order — loads the affected page.

4) Post-exploitation impact. Successful execution in an administrative session context can enable session/cookie theft, authenticated action forgery (creating rogue admin accounts, modifying plugin settings), redirection of visitors to malicious infrastructure, or credential phishing. Because scope is changed (S:C), the impact can extend beyond the vulnerable LearnPress component to the broader WordPress installation.

Impact Assessment

Business impact is significant for WordPress-based e-learning and course-selling platforms. Unauthenticated exploitation (guest checkout enabled) means any internet-facing LearnPress store with guest ordering is exposed with no credential requirement. Subscriber-level exploitation (guest checkout disabled) still allows a low-privilege attacker to stage attacks against higher-privileged users who view checkout data.

Blast radius: stored XSS payloads persist in the database and re-fire on every page load for every visitor to the injected order/comments view, creating a persistent compromise affecting both administrators and end users. Combined with the scope change (S:C), attackers may pivot from a low-privilege injection to full site compromise via admin session abuse. Confidentiality and integrity impacts are limited per CVSS (C:L, I:L), but real-world stored XSS in WordPress admin contexts frequently escalates to full takeover. No availability impact is directly scored.

There is no evidence of exploitation in the wild, no CISA KEV listing, and no public PoC — but the absence of a patch and the low skill barrier of XSS place this in a high-priority remediation queue for exposed sites.

Detection Guidance

Sigma Rule

title: LearnPress Stored XSS Payload in Checkout Comments or Quantity Parameter
id: 8f3c2a7e-1b6d-4e9a-9c2f-learnpress-xss
status: experimental
description: Detects HTTP requests to LearnPress checkout/REST endpoints carrying script-bearing payloads in order_comments or quantity parameters (CVE-2026-109208).
author: valtersit.com
logsource:
  category: webserver
detection:
  selection_path:
    cs-uri-stem|contains:
      - '/learnpress'
      - '/checkout'
      - '/wp-json/learnpress'
  selection_payload:
    cs-uri-query|contains:
      - 'order_comments='
      - 'quantity='
  selection_suspicious:
    cs-uri-query|contains:
      - '<script'
      - '%3Cscript'
      - 'javascript:'
      - 'onerror='
      - 'onload='
      - '<svg'
      - '%3Csvg'
      - 'document.cookie'
      - 'alert('
  condition: selection_path and selection_payload and selection_suspicious
fields:
  - c-ip
  - cs-method
  - cs-uri-stem
  - cs-uri-query
  - sc-status
falsepositives:
  - Legitimate course content containing HTML in comments
level: high

YARA Rule

rule CVE_2026_109208_LearnPress_Stored_XSS
{
    meta:
        description = "Detects stored XSS payloads targeting LearnPress quantity/order_comments parameters (CVE-2026-109208)"
        author = "valtersit.com"
        reference = "CVE-2026-109208"
        date = "2026-01-01"
        severity = "high"
    strings:
        $param1 = "order_comments" ascii nocase
        $param2 = "quantity" ascii nocase
        $lp = "learnpress" ascii nocase
        $s1 = "<script" ascii nocase nocase wide
        $s2 = "javascript:" ascii nocase wide
        $s3 = "onerror=" ascii nocase wide
        $s4 = "onload=" ascii nocase wide
        $s5 = "document.cookie" ascii nocase wide
        $s6 = "<svg" ascii nocase wide
        $s7 = "alert(" ascii nocase wide
    condition:
        ($param1 or $param2) and $lp and any of ($s*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-109208 LearnPress Stored XSS Payload in order_comments/quantity"; flow:to_server,established; http.uri; content:"order_comments"; nocase; http.uri; content:"<script"; nocase; distance:0; http.uri; content:"onerror="; nocase; pcre:"/(order_comments|quantity).*(%3Cscript|<script|%3Csvg|<svg|onerror%3D|onerror=|onload%3D|onload=)/iU"; classtype:web-application-attack; sid:2026109208; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=5s
  [network where url.path : ("*learnpress*", "*checkout*", "*wp-json/learnpress*")
     and url.query : ("*order_comments=*", "*quantity=*")]
  [network where url.query : ("*<script*", "*%3Cscript*", "*javascript:*",
                              "*onerror=*", "*onload=*", "*<svg*", "*%3Csvg*",
                              "*document.cookie*", "*alert(*")]

Splunk SPL Query

index=web_logs sourcetype=access_combined
| eval uri=lower(coalesce(uri_path,"") . "?" . coalesce(uri_query,""))
| where (match(uri, "learnpress") OR match(uri, "checkout") OR match(uri, "wp-json/learnpress"))
    AND (match(uri, "order_comments=") OR match(uri, "quantity="))
    AND (match(uri, "%3cscript") OR match(uri, "<script") OR match(uri, "javascript:")
         OR match(uri, "onerror=") OR match(uri, "onload=") OR match(uri, "%3csvg")
         OR match(uri, "<svg") OR match(uri, "document\.cookie") OR match(uri, "alert\("))
| stats count values(uri) as payloads dc(clientip) as unique_sources by clientip host
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="web,wordpress,learnpress,xss,">
  <rule id="2026109" level="10">
    <decoded_as>web-accesslog</decoded_as>
    <url type="pcre2">(?i)(learnpress|checkout|wp-json/learnpress)</url>
    <match type="pcre2">(?i)(order_comments|quantity)</match>
    <match type="pcre2">(?i)(%3Cscript|<script|javascript:|onerror=|onload=|%3Csvg|<svg|document\.cookie|alert\()</match>
    <description>CVE-2026-109208 - LearnPress stored XSS payload detected in checkout/REST request</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>attack,xss,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1) Immediate mitigations:

• Disable guest checkout in LearnPress settings until a patched version is released. This converts the exposure from unauthenticated to Subscriber-only, reducing the attack surface dramatically.
• Restrict or monitor Subscriber registration; require moderation/approval for new accounts if Subscriber-level exploitation is a concern.
• Deploy a Web Application Firewall (WAF) with XSS signatures targeted at the order_comments and quantity parameters; enforce input validation on both checkout and REST requests.
• Apply Content Security Policy (CSP) headers to restrict inline script execution and mitigate stored XSS impact.

2) Patch/upgrade steps:

• No vendor patch is currently available. Monitor the LearnPress plugin changelog and WordPress Plugin Directory for a security release addressing CVE-2026-109208.
• When a patched version is published, upgrade immediately and re-validate that payloads are properly sanitized on input and escaped on output.
• Re-scan the database for stored payloads in the plugin's order metadata and checkout-related tables (specifically order_comments fields and quantity values) and purge any malicious content.

3) Long-term hardening:

• Enforce defense-in-depth: server-side output encoding (WordPress esc_html, esc_attr, esc_url, wp_kses), nonces, and capability checks on all REST endpoints.
• Implement a plugin inventory and vulnerability management process including automated vulnerability scanning for WordPress components.
• Deploy CSP with script-src restrictions, HTTPOnly and Secure cookie flags, and monitor logs for XSS probes.
• Subscribe to WordPress security advisories and maintain a patch SLA for high-severity plugin vulnerabilities.

References

• NVD — CVE-2026-109208: https://nvd.nist.gov/vuln/detail/CVE-2026-109208
• MITRE CWE-79 (Improper Neutralization of Input During Web Page Generation): https://cwe.mitre.org/data/definitions/79.html
• LearnPress WordPress plugin directory (monitor for patched release): https://wordpress.org/plugins/learnpress/
• WordPress XSS hardening guidance (Data Validation): https://developer.wordpress.org/apis/security/data-validation/
• CISA KEV Catalog (not currently listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog