LearnPress WordPress Plugin PHP Object Injection Vulnerability

The LearnPress plugin for WordPress is vulnerable to PHP Object Injection in versions up to and including 4.4.10. The flaw occurs via deserialization of untrusted input from the 'checkout-email' request parameter during the checkout AJAX action.

The value is passed through sanitize_text_field(), which does not strip serialized object syntax. It is then stored in the LearnPress session and later fed to LP_Helper::maybe_unserialize() → unserialize() without an allowed_classes restriction by LP_Session_Handler::get() on subsequent requests.

• Affected versions: up to and including 4.4.10
• Attack vector: unauthenticated attackers via checkout AJAX
• Impact: PHP object injection