CVE-2026-104736 LearnPress <= 4.4.10 - Unauthenticated PHP Object Injection via 'checkout-email' Parameter

The LearnPress plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 4.4.10 via deserialization of untrusted input from the 'checkout-email' request parameter during the checkout AJAX action. The value is passed through sanitizetextfield, which does not stri...