Quick answers
- Is CVE-2026-104736 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-104736 being exploited in the wild.
- How severe is CVE-2026-104736?
- Critical severity, with a CVSS score of 9.8, published 17 October 2026.
- Which products and versions are affected?
- LearnPress up to and including 4.4.10.
- Is there a fix for CVE-2026-104736?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-104736 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-104736?
- Check whether you run LearnPress at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
PHP Object Injection vulnerability via unsafe deserialization in the LearnPress session handler. The 'checkout-email' AJAX parameter is sanitized with sanitize_text_field() but this does not prevent serialized object syntax from passing through. The value is stored in the session table and later deserialized by LP_Session_Handler::get() calling unserialize() without an allowed_classes restriction, enabling arbitrary object instantiation and potential RCE through PHP magic methods.
Affected products
- LearnPress LearnPress up to and including 4.4.10
Timeline
- 2026-10-17: disclosed