{"metadata": {"vulnerability": "CVE-2026-104736", "count": 29, "kinds": {"milestone": 4, "sighting": 15, "kev": 0, "other": 10}}, "data": [{"timestamp": "2026-10-02T11:52:06.705Z", "date_only": false, "value": "2026-10-02T11:52:06.705Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-104736", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-02T12:07:17Z", "date_only": false, "value": "2026-10-02T12:07:17.000Z", "kind": "other", "label": "Time", "source": "cvelistv5 / Wordfence", "record": "CVE-2026-104736", "field": "containers.cna.timeline.0.time"}, {"timestamp": "2026-10-16T14:33:32Z", "date_only": false, "value": "2026-10-16T14:33:32.000Z", "kind": "other", "label": "Time", "source": "cvelistv5 / Wordfence", "record": "CVE-2026-104736", "field": "containers.cna.timeline.1.time"}, {"timestamp": "2026-10-17T03:43:28.046Z", "date_only": false, "value": "2026-10-17T03:43:28.046Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-104736", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-17T03:43:28.046Z", "date_only": false, "value": "2026-10-17T03:43:28.046Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / Wordfence", "record": "CVE-2026-104736", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-17T03:50:13.448Z", "date_only": false, "value": "2026-10-17T03:50:13.448993Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117454209867538091", "record": "CVE-2026-104736", "field": "creation_timestamp", "uuid": "ffb16213-510c-429a-a0d1-397e564e25e4", "content": "CVE-2026-104736 LearnPress <= 4.4.10 - Unauthenticated PHP Object Injection via 'checkout-email' Parameter The LearnPress plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 4.4.10 via deserialization of untrusted input from the 'checkout-email' request parameter during the checkout AJAX action. The value is passed through sanitize_text_field(), which does not strip serialized object syntax, then stored in the LearnPress session table and later fed to LP_Helper::maybe_unserialize() \u2192 unserialize() (without an allowed_classes restriction) by LP_Session_Handler::get() on subsequent requests. This makes it possible for unauthenticated attackers to inject a PHP Object.\nhttps://www.cve.org/CVERecord?id=CVE-2026-104736https://www.wordfence.com/threat-intel/vulnerabilities/id/3e28e008-0ec1-4262-9ac0-6170cf8b8bdf?source=cvehttps://plugins.trac.wordpress.org/browser/learnpress/tags/4.4.9.1/inc/class-lp-session-handler.php#L373https://plugins.trac.wordpress.org/browser/learnpress/tags/4.4.9.1/inc/class-lp-checkout.php#L377https://plugins.trac.wordpress.org/browser/learnpress/tags/4.4.9.1/inc/class-lp-checkout.php#L523https://plugins.trac.wordpress.org/browser/learnpress/tags/4.4.9.1/inc/class-lp-ajax.php#L21https://plugins.trac.wordpress.org/changeset?reponame=&old=3750024%40learnpress&new=3750024%40learnpress#wordpress #thimpress #LearnPress\u2013WordPressLMSPluginforCreateandSellOnlineCourses#CVE_2026_104736#bot", "url": "https://infosec.exchange/users/cve/statuses/117454209867538091"}, {"timestamp": "2026-10-17T04:02:33.119Z", "date_only": false, "value": "2026-10-17T04:02:33.119390Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/suriq.io/post/3my27guc5sx2z", "record": "CVE-2026-104736", "field": "creation_timestamp", "uuid": "90efe531-0978-4bc5-8396-4c46f972c250", "content": "CVE-2026-104736: LearnPress for WordPress has an unauthenticated PHP object injection flaw, a LearnPress authorization bypass (CVE-2026-107744) and a stored XSS in EU VAT Assistant for WooCommerce (CVE-2026-103899). No fixes stated; none confirmed exploited.", "url": "https://bsky.app/profile/suriq.io/post/3my27guc5sx2z"}, {"timestamp": "2026-10-17T04:16:47Z", "date_only": false, "value": "2026-10-17T04:16:47Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-XCHC-MCCM-X286", "record": "GHSA-XCHC-MCCM-X286", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-17T04:16:47.780Z", "date_only": false, "value": "2026-10-17T04:16:47.780", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-104736", "record": "FKIE_CVE-2026-104736", "field": "published"}, {"timestamp": "2026-10-17T04:30:25.839Z", "date_only": false, "value": "2026-10-17T04:30:25.839846Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/offseq/statuses/117454367956953411", "record": "cve-2026-104736", "field": "creation_timestamp", "uuid": "c775fade-de35-4114-b16b-b7ede76e9c9b", "content": "CVE-2026-104736: LearnPress (\u22644.4.10) has a CRITICAL PHP Object Injection flaw (CVSS 9.8) via 'checkout-email' \u2014 enables unauth RCE & system takeover. No patch yet; restrict AJAX checkout now. https://radar.offseq.com/threat/cve-2026-104736-cwe-502-deserialization-of-untrusted-data-in-thimpress-learnpress-wordpress-lms-plugin-da26ea8c610f8fca #OffSeq #WordPress #Vuln #Infosec", "url": "https://infosec.exchange/users/offseq/statuses/117454367956953411"}, {"timestamp": "2026-10-17T04:30:27.842Z", "date_only": false, "value": "2026-10-17T04:30:27.842082Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3my2ayqztlm2m", "record": "cve-2026-104736", "field": "creation_timestamp", "uuid": "d38eecc9-e2d8-4733-8436-dfd8cc46db7c", "content": "LearnPress LMS plugin (\u22644.4.10) hit by CRITICAL PHP Object Injection (CVE-2026-104736) via checkout-email. Full site compromise possible. Restrict checkout AJAX now \u2014 no patch yet. https://radar.offseq.com/threat/cve-2026-104736-cwe-502-deserialization-of-untrusted-data-in-thimpress-learnpress-wo...", "url": "https://bsky.app/profile/offseq.bsky.social/post/3my2ayqztlm2m"}, {"timestamp": "2026-10-17T06:01:21.910Z", "date_only": false, "value": "2026-10-17T06:01:21.910602Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/raven-sec.bsky.social/post/3my2g37r5qdtm", "record": "CVE-2026-104736", "field": "creation_timestamp", "uuid": "70360549-8373-423e-92df-eaa5c7ba0fb6", "content": "BeyondTrust CVE-2026-102764 actively exploited\u2014patch now\n\n\u2022 BlockStrap RCE on Magento/Commerce (08936e4)\n\u2022 LearnPress CVSS 9.8 PHP injection flaw (CVE-2026-104736)\n\n4 sources verified \u00b7 hackingallthethings.com\n#infosec #threatintel #cybersecurity #Vulnerability #BeyondTrust", "url": "https://bsky.app/profile/raven-sec.bsky.social/post/3my2g37r5qdtm"}, {"timestamp": "2026-10-17T06:05:24.571Z", "date_only": false, "value": "2026-10-17T06:05:24.571640Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3my2gck52pr24", "record": "CVE-2026-104736", "field": "creation_timestamp", "uuid": "6d9cf7fe-a7fe-433a-92f3-3044d2f5d666", "content": "\ud83d\udd34 CVE-2026-104736 - Critical (9.8)\n\nThe LearnPress plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and ...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-104736/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "url": "https://bsky.app/profile/thehackerwire.bsky.social/post/3my2gck52pr24"}, {"timestamp": "2026-10-17T06:07:12.654Z", "date_only": false, "value": "2026-10-17T06:07:12.654189Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3my2gfrmb4i27", "record": "CVE-2026-104736", "field": "creation_timestamp", "uuid": "7806862e-1c4e-4c7f-aa1e-7a57eba3e8b5", "content": "\ud83d\udea8 CVE-2026-104736 \u2014 CVSS 9.8 CRITICAL\n\nThe LearnPress plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including,...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-104736\n\n#CVE #CyberSecurity #InfoSec", "url": "https://bsky.app/profile/stemshop.bsky.social/post/3my2gfrmb4i27"}, {"timestamp": "2026-10-17T06:30:04.776Z", "date_only": false, "value": "2026-10-17T06:30:04.776723Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3my2honu3yg2o", "record": "CVE-2026-104736", "field": "creation_timestamp", "uuid": "5cee0c63-6b1b-45ae-a456-69b2dede93be", "content": "CVE-2026-104736 - learnpress \u2013 wordpress lms plugin for create and sell online courses\nThe LearnPress learning management plugin for WordPress lets anyone send specially crafted data in the checkout email field,\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#thimpress #CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3my2honu3yg2o"}, {"timestamp": "2026-10-17T06:30:31Z", "date_only": false, "value": "2026-10-17T06:30:31Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-XCHC-MCCM-X286", "record": "GHSA-XCHC-MCCM-X286", "field": "published"}, {"timestamp": "2026-10-17T06:30:31Z", "date_only": false, "value": "2026-10-17T06:30:31Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-XCHC-MCCM-X286", "record": "GHSA-XCHC-MCCM-X286", "field": "modified"}, {"timestamp": "2026-10-17T10:01:51.553Z", "date_only": false, "value": "2026-10-17T10:01:51.553099Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/undercode.bsky.social/post/3my2tjdl6r224", "record": "CVE-2026-104736", "field": "creation_timestamp", "uuid": "bc43f395-74d9-4982-ba8d-f24a8ec24ce2", "content": "Critical CVE-2026-104736 and CVE-2026-110653: Unauthenticated Flaws in LearnPress and LatePoint Threatening WordPress Deployments +\u00a0Video\n\nIntroduction: Recent threat intelligence highlights two critical, unauthenticated vulnerabilities affecting widely used WordPress plugins\u2014LearnPress\u2026", "url": "https://bsky.app/profile/undercode.bsky.social/post/3my2tjdl6r224"}, {"timestamp": "2026-10-17T10:32:11.215Z", "date_only": false, "value": "2026-10-17T10:32:11.215460Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/postac001.bsky.social/post/3my2v7li5ni22", "record": "CVE-2026-104736", "field": "creation_timestamp", "uuid": "aa17d392-778e-488b-98ab-96765fee0678", "content": "WordPress\u30d7\u30e9\u30b0\u30a4\u30f3LearnPress v4.4.10\u4ee5\u524d\u3067\u3001\u30c1\u30a7\u30c3\u30af\u30a2\u30a6\u30c8\u51e6\u7406\u306e\u300ccheckout-email\u300d\u30d1\u30e9\u30e1\u30fc\u30bf\u7d4c\u7531\u3067PHP\u30aa\u30d6\u30b8\u30a7\u30af\u30c8\u30a4\u30f3\u30b8\u30a7\u30af\u30b7\u30e7\u30f3\u306e\u8106\u5f31\u6027\u3002\u8a8d\u8a3c\u306a\u3057\u3067\u653b\u6483\u2026\nCVE-2026-104736 CVSS 9.8 | CRITICAL", "url": "https://bsky.app/profile/postac001.bsky.social/post/3my2v7li5ni22"}, {"timestamp": "2026-10-17T18:19:37.463Z", "date_only": false, "value": "2026-10-17T18:19:37.463171Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/alt.pds.lefht.cc/post/3my3p3nlzck2x", "record": "CVE-2026-104736", "field": "creation_timestamp", "uuid": "842cdc01-4bd4-4ac9-8233-78b8885ab923", "content": "\ud83d\udee1\ufe0f Most-discussed CVEs on Bluesky, last 24h\n\n1. CVE-2026-99999 \u00b7 43 people\n2. CVE-2026-102764 \u00b7 20 people \ud83d\udd25\n3. CVE-2025-61624 \u00b7 11 people \ud83d\udd25\n4. CVE-2026-103849 \u00b7 8 people\n5. CVE-2026-104736 \u00b7 8 people\n\n\ud83d\udd25 = on CISA's Known Exploited list \u00b7 details in the thread \ud83e\uddf5", "url": "https://bsky.app/profile/alt.pds.lefht.cc/post/3my3p3nlzck2x"}, {"timestamp": "2026-10-17T18:24:54.349Z", "date_only": false, "value": "2026-10-17T18:24:54.349852Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/alt.pds.lefht.cc/post/3my3p3nw7i22x", "record": "CVE-2026-104736", "field": "creation_timestamp", "uuid": "45f59e10-7012-4e4f-9560-711df2b6ea58", "content": "5. CVE-2026-104736 \u00b7 8 people\n\ud83d\udfe5 Critical 9.8 \u00b7 thimpress LearnPress \u2013 WordPress LMS Plugin for Create and Sell Online Courses\n\nLearnPress <= 4.4.10 - Unauthenticated PHP Object Injection via 'checkout-email' Parameter", "url": "https://bsky.app/profile/alt.pds.lefht.cc/post/3my3p3nw7i22x"}, {"timestamp": "2026-10-17T21:05:54.748Z", "date_only": false, "value": "2026-10-17T21:05:54.748084Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/vulnsea.com/post/3my3ymrjxw62p", "record": "CVE-2026-104736", "field": "creation_timestamp", "uuid": "36c99939-4443-41ea-a6c6-57da2e428464", "content": "\ud83c\udf0a ABYSSAL \u00b7 critical with a public exploit\nCVE-2026-104736: LearnPress <= 4.4.10 - Unauthenticated PHP Object Injection via 'checkout-email' Parameter\nCVSS 9.8 \u00b7 EPSS 0.4%\nhttps://beta.vulnsea.com/cve/CVE-2026-104736\n\n#CVE #infosec #cybersecurity #threatintel", "url": "https://bsky.app/profile/vulnsea.com/post/3my3ymrjxw62p"}, {"timestamp": "2026-10-17T22:07:04.804Z", "date_only": false, "value": "2026-10-17T22:07:04.804627Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/vulnsea.com/post/3my4423u4dt2p", "record": "CVE-2026-104736", "field": "creation_timestamp", "uuid": "d80dcb81-bbb2-435b-8acc-9902bc858194", "content": "\ud83c\udf0a ABYSSAL \u00b7 critical with a public exploit\nCVE-2026-104736: LearnPress <= 4.4.10 - Unauthenticated PHP Object Injection via 'checkout-email' Parameter\nCVSS 9.8 \u00b7 EPSS 0.4%\nhttps://beta.vulnsea.com/cve/CVE-2026-104736\n\n#CVE #infosec #cybersecurity #threatintel", "url": "https://bsky.app/profile/vulnsea.com/post/3my4423u4dt2p"}, {"timestamp": "2026-10-18T11:08:40.232Z", "date_only": false, "value": "2026-10-18T11:08:40.232447Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-104736", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-10-18T11:08:40.232Z", "date_only": false, "value": "2026-10-18T11:08:40.232447Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-104736", "record": "FKIE_CVE-2026-104736", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-10-18T11:22:46.937Z", "date_only": false, "value": "2026-10-18T11:22:46.937Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-104736", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-18T11:22:46.937Z", "date_only": false, "value": "2026-10-18T11:22:46.937Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-104736", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-19T00:00:13.033Z", "date_only": false, "value": "2026-10-19T00:00:13.033938Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/pulse-wp.com/post/3my6stdzcb22x", "record": "CVE-2026-104736", "field": "creation_timestamp", "uuid": "191e5a77-0a69-4a08-9c21-0088d8899e98", "content": "CVE-2026-104736. LearnPress up to 4.4.10. CVSS 9.8. Unauthenticated attackers inject PHP objects during checkout. Database dumps. wp-config access. Your server compromised.\n\nNo patch available. Disable LearnPress now.\n\nScan your WordPress site: pulse-wp.com\n#WordPress #CVE #CyberSecurity", "url": "https://bsky.app/profile/pulse-wp.com/post/3my6stdzcb22x"}, {"timestamp": "2026-10-19T15:16:45.150Z", "date_only": false, "value": "2026-10-19T15:16:45.150", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-104736", "record": "FKIE_CVE-2026-104736", "field": "lastModified"}]}