rootpwn

critical · CVSS v3 9.8 · EPSS 0.00438

CVE-2026-104736

The LearnPress plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 4.4.10 via d…

Description

The LearnPress plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 4.4.10 via deserialization of untrusted input from the 'checkout-email' request parameter during the checkout AJAX action. The value is passed through sanitize_text_field(), which does not strip serialized object syntax, then stored in the LearnPress session table and later fed to LP_Helper::maybe_unserialize() → unserialize() (without an allowed_classes restriction) by LP_Session_Handler::get() on subsequent requests. This makes it possible for unauthenticated attackers to inject a PHP Object.

Scores

Severity
critical
CVSS v2
10
CVSS v3
9.8
CVSS v4
—
EPSS
0.00438

← All CVEs

Related CVEs

critical

CVE-2026-110653

The LatePoint Appointment Booking Plugin for WordPress is vulnerable to an authentication bypass due to a race condition in OTP verification. Unauthenticated attackers can brute‑force the 6‑digit code by exploiting a TOCTOU window, gaining full access to a target customer's account. This flaw affects all plugin versions up to 5.7.4.

View analysis

critical

CVE-2026-111853

Tektronix 3 Series MDO devices before firmware 1.21.1 are vulnerable to OS command injection via the FILESystem:MOUNT:DRIve SCPI command. Attackers can execute arbitrary commands with elevated privileges, potentially compromising the entire instrument. This flaw can lead to full system compromise.

View analysis

critical

CVE-2026-109515

The MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc. plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.2.78.6 This is due to the `subscribe_to_email_list` endpoint accepting an attacker-supplied `optin_data[form_custom_field_mappings]` parameter without any allow-list validation on destination keys, allowing the attacker-controlled mapping to override the administrator's saved mapping and pass arbitrary `wp_users` column names — including `ID` and `user_pass` — directly into `wp_insert_user()` via the `subscribe()` function. This makes it possible for unauthenticated attackers to force `wp_insert_user()` into UPDATE mode on any existing account by supplying a target user's numeric `ID`, overwrite that account's password with a pre-hashed value of their choosing, and thereby take over any WordPress user account — including administrators — leading to full site compromise. Exploitation requires that a WordPress User Registration opt-in form is published somewhere on the site, though the form's UUID is visible in page source and no authentication, nonce, or capability check is required to reach the vulnerable endpoint.

View analysis

critical

CVE-2026-111681

EFAK through 5.1.0 contains a missing authorization vulnerability that allows authenticated low-privilege users to manage accounts because the /api/users endpoints lack administrator role checks. Attackers can send POST, PUT, or DELETE requests to UserController to grant themselves ROLE_ADMIN, create administrators, or delete users, gaining control of managed Kafka clusters.

View analysis