The plugin deserializes untrusted XML files during import, enabling PHP Object Injection for users with Administrator+ privileges. An attacker can supply crafted data that causes a malicious object to be instantiated. Since the plugin itself contains no pre‑existing POP chain, the flaw alone cannot execute code or modify files. However, if another plugin or theme on the same WordPress site implements a POP chain, the injected object can be leveraged to delete or read files, exfiltrate sensitive information, or run arbitrary code, depending on the chain present.

Vulnerable versions are all releases of LearnPress – Backup & Migration Tool up to and including 4.1.4, distributed by thimpress. No other product or version is explicitly listed as affected.

The CVSS score of 6.6 indicates a moderate severity flaw. No EPSS score is available and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires authenticated Administrator access and a compatible POP chain in a companion plugin or theme; without such a chain the impact is limited to data model tampering. The threat remains conditional on the presence of additional vulnerable code on the site.