LearnPress Security Update: Patch It First

If you run LearnPress, update it to version 4.4.11 or later today. That is the whole first paragraph of this guide, and everything else is detail. The current release on wordpress.org is 4.4.12, so updating to the latest version covers it.

The reason is a vulnerability published on 17 October 2026 as CVE-2026-104736. It affects LearnPress versions up to and including 4.4.10, it needs no login to reach, and it carries a severity score of 9.8 out of 10, which is the “critical” band. The fix shipped in 4.4.11 on 16 October.

This post has two parts. The first is the update and the checks that go with it. The second is for people who read the news and started wondering whether LearnPress is still the right plugin for them. That question deserves a calm answer after the site is safe, not before. If you only came for the fix, stop reading after the section on signs of compromise. Nothing in the second half is required.

What the advisory says

The flaw is a PHP object injection. LearnPress takes an email address from the checkout form, in a request parameter called checkout-email, and runs it through WordPress’s standard text cleaner. That cleaner removes tags and stray whitespace, but it does not remove the syntax PHP uses to write an object out as text. The value is then saved in LearnPress’s session storage. On a later request, LearnPress reads the saved value back and rebuilds it with PHP’s unserialize() without restricting which classes may be created.

Put plainly, a stranger can hand your site a piece of text that PHP later turns back into a live object. Nobody has to log in for this to work, because the checkout request is open to visitors.

Here are the facts, as published:

• CVE: CVE-2026-104736, assigned by Wordfence and listed in the National Vulnerability Database.
• Affected: LearnPress up to and including 4.4.10.
• Fixed in: 4.4.11, released 16 October 2026. The vendor changelog says “Fixed: security” and credits several outside researchers. It does not name the CVE, so the link between the release and the CVE rests on the version range in the advisories. The Wordfence record lists 4.4.10 as the last affected version, and WPScan titles its entry “LearnPress < 4.4.11”.
• Severity: 9.8, critical, scored as network reachable, low complexity, no privileges and no user interaction.
• Published: 17 October 2026, with the record last updated on 18 October.
• Current LearnPress release at the time of writing: 4.4.12, dated 23 October 2026.

Two details help you size the risk honestly.

First, a PHP object injection is only as dangerous as the classes available on your particular site. The score of 9.8 assumes the worst case. In practice, an attacker needs a class somewhere in your plugins, your theme or WordPress itself that does something harmful when an object of that class is created or destroyed. Some sites have such a class and some do not, and you cannot easily tell which you are from the outside. That is a reason to be a little less alarmed, and it is not a reason to skip the update, because you cannot rule the chain out and the fix is free.

Second, the National Vulnerability Database entry for this CVE was still marked as awaiting its own analysis when we checked, and the severity shown there is the one supplied by Wordfence. A federal coordinator note dated 18 October rated exploitation as “none” at that time, with the flaw marked as easy to automate and the technical impact as total. “None” was a statement about that date. It is not a promise about today. Treat any unauthenticated, automatable flaw in a checkout path as something that scanners will find quickly.

LearnPress has had other advisories this year too, several of them smaller and fixed in releases between 4.3 and 4.4.4. That is normal for a plugin of this size and age, and it is the reason the habit matters more than any single CVE: a site that updates its LMS plugin within days of a fix is in a different position from one that updates once a quarter.

Step 1: check which version you run

You can find the version in two places.

1. In the WordPress admin, open Plugins and look at the line under LearnPress. The version number sits next to the author name.
2. Over the command line, run wp plugin get learnpress --field=version.

If the number is 4.4.10 or lower, you are exposed. If it is 4.4.11 or higher, the checkout flaw is closed on that site, and you can go straight to the checks below to confirm nothing happened before you updated.

Also look at the add-ons. LearnPress sells and ships many of its features as separate plugins, and each has its own version. An add-on that has not been updated can sit on an older, incompatible release of the core and produce errors after the core update. Open the Plugins screen, filter to “Update available”, and note every LearnPress add-on that shows an update.

If you manage more than one site, repeat this for each one. The affected range includes every install, so a staging copy that sits on the public internet counts as a live target.

Step 2: update

Back up first. A database dump and a copy of wp-content is enough. If your host keeps daily snapshots, confirm the last one is recent and move on.

Then update in this order:

1. Update the LearnPress core plugin to the latest version, 4.4.12 at the time of writing.
2. Update the LearnPress add-ons that offered an update.
3. Clear any page cache or object cache, so visitors do not receive a cached checkout page built on old code.

You can do it from the admin with the Update now link, or from the command line with wp plugin update learnpress. After the update, open a course page, add a course to the cart and walk through to the checkout screen as a visitor. You are looking for a page that loads and shows the form, not for a completed payment. If you take payments through an add-on, run one small real or test transaction as well.

If you cannot update today because you need to test against a theme or a custom add-on, you have a harder choice. The option with the least damage is to take the checkout page offline for visitors, or to put the whole site behind a maintenance page, until the update is done. A web application firewall rule may block this specific request, but a rule is a stopgap that depends on someone else having written and shipped it, and it is not a substitute for the fix.

Consider turning on automatic updates for LearnPress after this. On the Plugins screen, each plugin has an “Enable auto-updates” link. For a plugin that handles checkout, a bad update is less costly than a known unauthenticated flaw that sits unpatched for a week. If you worry about a breaking release, keep a staging site that mirrors production and let it update a day ahead.

Step 3: review admin users and recent changes

The point of this step is to find out whether anyone used the flaw before you updated. The window that matters starts a few days before 16 October and ends the moment you updated.

Administrator accounts. Open Users, filter to Administrator, and read every line. You are looking for names you do not recognise and for accounts created recently. From the command line, wp user list --role=administrator --fields=ID,user_login,user_email,user_registered prints the same list with the registration date, which is the quickest way to spot a new arrival. While you are there, look at Editors and any custom roles that can install plugins or edit files.

Plugins and themes. Compare the installed list against what you meant to install. An unfamiliar plugin, or a plugin you deleted that is back, is a signal. Run wp plugin list and wp theme list and read both.

File integrity. WordPress can check its own core files against the official checksums with wp core verify-checksums, and it can do the same for plugins that come from wordpress.org with wp plugin verify-checksums --all. Any file reported as modified or unexpected needs an explanation. Premium add-ons from other sources will not appear in that check, so read their folders by eye or compare them against a fresh download.

PHP files in places they do not belong. Look inside wp-content/uploads. That folder should hold images, documents and similar media. A .php file in there is almost always unwelcome. find wp-content/uploads -name '*.php' lists them.

Scheduled tasks and settings. Run wp cron event list and look for jobs you do not recognise. Check the site address settings with wp option get siteurl and wp option get home, and read the active plugin list in the options table if you can.

Content changes. Look at the most recently modified posts and pages for injected links, hidden text or redirects. Open the site on a phone, from a search result, because some injections only show to visitors who arrive from a search engine.

Step 4: look for signs of compromise

Many hosts keep access logs for a few weeks. If yours does, they are the best evidence you have.

• Search the logs for POST requests to admin-ajax.php that carry a checkout-email field. A normal request holds an email address. A suspicious one holds something that starts with a letter, a colon and a number, for example the pattern O: followed by digits, or the encoded form O%3A. That shape is how PHP writes an object as text.
• Look at the LearnPress session storage in the database. It is a custom table with your WordPress table prefix. Rows whose stored value contains serialized objects, rather than ordinary session data, deserve a closer look. Deleting expired sessions is routine, and LearnPress does it on a schedule, so an absence of old rows proves little.
• Check the error log for PHP warnings that mention unserialize, or for fatal errors from classes you do not recognise, around the time of an unusual request.
• Ask your host whether their malware scanner has flagged anything, and what it covers.

If you find something, do not tidy it up quietly. Take a copy of the site as it stands for later study, then change the passwords of every administrator and of the database user, regenerate the secret keys in wp-config.php (wp config shuffle-salts does it), reinstall WordPress core and every plugin from clean copies, and review the user list again. A full clean-up of an infected site is a larger job than a plugin update. If you do not have the time or the experience, a professional clean-up costs less than a second compromise.

If you find nothing, write down what you checked and the date. That note is useful the next time an advisory appears, and it is what you will want if a customer or an insurer asks.

Only after the site is safe: is it time to move?

A vulnerability in a plugin is not, by itself, a reason to leave that plugin. Every major WordPress LMS plugin has had advisories, and so will the one you move to. What a vulnerability does tell you is how the vendor reacts. In this case the fix shipped before the CVE became public, and a plugin with a large user base had a patched release within days. That is the system working.

What the news may have done is make you notice something you already felt. Perhaps you spend more time updating add-ons than teaching. Perhaps checkout, certificates and drip sit in separate add-ons with separate renewal dates. Perhaps your course catalogue has grown past what the plugin was built for. Those are legitimate reasons to look at other options, and a security notice is a fair moment to look.

Reasons to stay on LearnPress are real too. It has a long history and a large installed base. There are more themes, tutorials and forum threads built around it than around a newer plugin, which matters if you like to find an answer by searching. If your site works, the add-ons you pay for do what you need, and you update promptly, a move is cost without much benefit. We say the same thing on the Learnomy vs LearnPress comparison, where the section on where LearnPress is the better fit is not decoration.

A neutral way to decide is to write down three numbers: what you spend on LearnPress add-ons each year, how many hours you spend keeping them current, and how many separate plugins your checkout depends on. If the answers are small, stay. If they are large, keep reading.

What a move to Learnomy involves, honestly

Learnomy is a free WordPress LMS plugin from Wbcom Designs, the company that publishes this site. It runs on your own WordPress install, like LearnPress. Its free version includes Stripe and PayPal checkout, memberships, six quiz question types and certificates with a public verification page. Content drip, cohorts, learning paths and advanced quizzes are Pro features. The comparison page lays this out side by side, with the add-on costs on the LearnPress side.

Here is the part that matters for a migration, and it is less convenient than the marketing line suggests: Learnomy has no importer for LearnPress. The built-in import wizard and the wp learnomy migrate command read three source plugins only, which are LearnDash, Tutor LMS and LifterLMS. The guide to migrating from another LMS describes what that importer covers. A LearnPress site is not on that list, so the move is a rebuild, done by hand or with your own script.

That has consequences you should weigh before committing.

What you rebuild. Courses, sections, lessons and quizzes need to be recreated in Learnomy. For a small catalogue, that is manual work: copy the lesson text, re-embed or re-upload the media, and rebuild the quiz settings. A course with a dozen lessons is an afternoon’s work, and a catalogue of fifty courses is a project. Lessons are written in the Learnomy editor, so pasted text will need a formatting pass.

Questions can move in bulk. The Question Bank in Learnomy has a CSV import. The documented way to build a file is to create one question of each type by hand, export, and then add your rows to the exported file, so the answer format is correct. See the Question Bank guide. If you can pull your LearnPress questions into a spreadsheet, this saves a lot of retyping, though you will need to reshape the answers into the format the file expects.

Your people stay, their records do not. Students are ordinary WordPress users, and if you install Learnomy on the same site, their accounts and logins remain. What LearnPress holds about them does not transfer: enrolments, lesson progress, quiz attempts and certificates issued. You will need to enrol people into the new courses, and decide what to tell students whose progress will not carry over. Keep the LearnPress data in place, and do not delete its tables, for as long as you may need to answer a question about someone’s history.

Money stays where it is. Treat past orders and subscription records as belonging to your payment provider and to the old plugin. Learnomy’s own importer, for the sources it does support, deliberately leaves payments alone, and the same caution applies here. Set prices on each Learnomy course after you build it.

Run both for a while. You can have the two plugins active on one site. Build one course in Learnomy, let a small group use it, and compare how it behaves before you move the rest. The old plugin keeps serving the courses you have not moved, so keep it updated for the whole of that period. A LearnPress install you have stopped caring about is the one most likely to be hit by the next advisory.

Do the work on a staging copy first. Clone the site, install Learnomy there, and rebuild one course end to end, including the checkout. That tells you how long the whole catalogue will take, which is the number you actually need.

The honest summary: a move is worth it when you want a different shape of product and you have the time to rebuild. It is not a way to escape a one-off CVE, and it is not quick. If you are weighing it, this earlier comparison of LearnDash and LearnPress and the page on Learnomy as a LearnPress alternative cover the product differences in more detail.

Learnomy needs the same discipline

Learnomy is software, and software has flaws. It is a plugin on WordPress like any other, and a site running it needs the same habits you should be applying to LearnPress today: keep it updated, keep a staging copy, keep backups you have tested, review administrator accounts on a schedule, and read the changelog of whatever sits on your checkout path. Nothing about a new plugin makes those habits optional. If you do move, put a reminder in your calendar to check for updates weekly. Any plugin that takes payments earns that.

A short checklist to keep

1. Confirm the LearnPress version is 4.4.11 or higher, and aim for the latest.
2. Update every LearnPress add-on, then test a course page and the checkout as a visitor.
3. Read the administrator list, the plugin list and the scheduled tasks.
4. Run the core and plugin checksum checks and look for PHP files in uploads.
5. Search your access logs for checkout requests that carry serialized-object text.
6. If you find a sign of compromise, clean up properly and rotate every credential.
7. Only then, decide whether the plugin still suits your site, and price a move with a staging test before you commit.

The update takes ten minutes. The decision about the future of your course site can take as long as it needs.