CVE-2026-104736Published
LearnPress <= 4.4.10 - Unauthenticated PHP Object Injection via 'checkout-email' Parameter
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-104736 · Microsoft / collected KEV context
cve-program · CVE-2026-104736
- https://www.wordfence.com/threat-intel/vulnerabilities/id/3e28e008-0ec1-4262-9ac0-6170cf8b8bdf?source=cve
- https://plugins.trac.wordpress.org/browser/learnpress/tags/4.4.9.1/inc/class-lp-session-handler.php#L373
- https://plugins.trac.wordpress.org/browser/learnpress/tags/4.4.9.1/inc/class-lp-checkout.php#L377
- https://plugins.trac.wordpress.org/browser/learnpress/tags/4.4.9.1/inc/class-lp-checkout.php#L523
- https://plugins.trac.wordpress.org/browser/learnpress/tags/4.4.9.1/inc/class-lp-ajax.php#L21
- https://plugins.trac.wordpress.org/changeset?reponame=&old=3750024%40learnpress&new=3750024%40learnpress
Related operational evidence
Explicit CVE identifiersNo related operational record is retained in the current change model.