The LearnPress plugin contains PHP Object Injection via the checkout-email request parameter. The value is sanitized only by a generic text filter, then stored in a session and later unserialized without any class restriction. An attacker can supply a crafted serialized payload that, when deserialized, instantiates objects that execute arbitrary code, providing a full remote code execution vector for unauthenticated users.

The vulnerability affects the LearnPress WordPress LMS plugin developed by Thimpress. Versions up to and including 4.4.10 are impacted; any release without the fix, such as 4.4.10 or earlier, must be updated.

With a CVSS score of 9.8 the flaw is considered critical and could be exploited by simply sending a specially crafted request to the checkout AJAX endpoint. No authentication or privileged access is required. While the EPSS score is not available, the lack of a KEV listing does not reduce the risk, because the attack path is straightforward and the potential impact is severe. The most likely vector is an unauthenticated POST to the checkout action with a malicious checkout‑email value. Once processed, the server deserializes the data and PHP code can execute with the permissions of the web process.