Baitaphish
Security intelligence
SearchLatest briefing
CVE Explorer

CVE-2026-7566

The LearnPress – Backup & Migration Tool plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.1.4 via deserialization of untrusted input . This makes it possible for authenticated attackers, with administrator-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chai
Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:193da3a5576689ae3db01d9414edcc6f0df488295bfabe8847bec69007cdf3fe
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
0

Affected products and versions

1 source assertion
{"defaultStatus":"unaffected","product":"LearnPress – Backup & Migration Tool","vendor":"thimpress","versions":[{"lessThanOrEqual":"4.1.4","status":"affected","version":"0","versionType":"semver"}]}
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:163d54fdfea255fc73b4ad858e059e1d5ff3a22d1f48d2b9a8d4cc1abfac5c04 · sha256:ed5598874177d90a… · /containers/cna/affected/0

Provider-owned CVSS observations

1 source assertion
{"metric":{"baseScore":6.6,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"metric_type":"cvssV3_1"}
  • cve_program_cvelist_v5cvss
    urn:baitaphish:normalized-source-record:v2:163d54fdfea255fc73b4ad858e059e1d5ff3a22d1f48d2b9a8d4cc1abfac5c04 · sha256:ed5598874177d90a… · /containers/cna/metrics/0/cvssV3_1

CWE assertions

1 source assertion
{"cweId":"CWE-502","description":"CWE-502 Deserialization of Untrusted Data","lang":"en","type":"CWE"}
  • cve_program_cvelist_v5cwe
    urn:baitaphish:normalized-source-record:v2:163d54fdfea255fc73b4ad858e059e1d5ff3a22d1f48d2b9a8d4cc1abfac5c04 · sha256:ed5598874177d90a… · /containers/cna/problemTypes/0/descriptions/0

Source references

8 source assertions
{"url":"https://plugins.trac.wordpress.org/browser/learnpress-import-export/tags/4.1.1/inc/admin/providers/learnpress/class-lp-import-learnpress.php#L581"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:163d54fdfea255fc73b4ad858e059e1d5ff3a22d1f48d2b9a8d4cc1abfac5c04 · sha256:ed5598874177d90a… · /containers/cna/references/5
{"url":"https://plugins.trac.wordpress.org/browser/learnpress-import-export/tags/4.1.1/inc/parsers.php#L871"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:163d54fdfea255fc73b4ad858e059e1d5ff3a22d1f48d2b9a8d4cc1abfac5c04 · sha256:ed5598874177d90a… · /containers/cna/references/6
{"url":"https://plugins.trac.wordpress.org/browser/learnpress-import-export/tags/4.1.4/inc/admin/providers/learnpress/class-lp-import-learnpress.php#L581"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:163d54fdfea255fc73b4ad858e059e1d5ff3a22d1f48d2b9a8d4cc1abfac5c04 · sha256:ed5598874177d90a… · /containers/cna/references/2
{"url":"https://plugins.trac.wordpress.org/browser/learnpress-import-export/tags/4.1.4/inc/parsers.php#L871"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:163d54fdfea255fc73b4ad858e059e1d5ff3a22d1f48d2b9a8d4cc1abfac5c04 · sha256:ed5598874177d90a… · /containers/cna/references/4
{"url":"https://plugins.trac.wordpress.org/browser/learnpress-import-export/tags/4.1.5/inc/functions.php#L384"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:163d54fdfea255fc73b4ad858e059e1d5ff3a22d1f48d2b9a8d4cc1abfac5c04 · sha256:ed5598874177d90a… · /containers/cna/references/7
{"url":"https://plugins.trac.wordpress.org/browser/learnpress-import-export/trunk/inc/admin/providers/learnpress/class-lp-import-learnpress.php#L581"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:163d54fdfea255fc73b4ad858e059e1d5ff3a22d1f48d2b9a8d4cc1abfac5c04 · sha256:ed5598874177d90a… · /containers/cna/references/1
{"url":"https://plugins.trac.wordpress.org/browser/learnpress-import-export/trunk/inc/parsers.php#L871"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:163d54fdfea255fc73b4ad858e059e1d5ff3a22d1f48d2b9a8d4cc1abfac5c04 · sha256:ed5598874177d90a… · /containers/cna/references/3
{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2f796373-7116-4fd3-9d53-5f520e6e1a0c?source=cve"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:163d54fdfea255fc73b4ad858e059e1d5ff3a22d1f48d2b9a8d4cc1abfac5c04 · sha256:ed5598874177d90a… · /containers/cna/references/0

Attribution and limitations

  • CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer