CVE-2026-7566: PHP Object Injection in LearnPress Backup & Migration Tool (CVSS 6.6)

Technical summary

CVE-2026-7566 is a PHP Object Injection vulnerability (CWE-502) in LearnPress – Backup & Migration Tool versions up to 4.1.4. The vulnerability exists in the plugin's deserialization of untrusted input, allowing an authenticated administrator to inject a crafted PHP object. The severity of exploitation depends entirely on the presence of a gadget chain (POP chain) within other installed plugins or themes. Without an exploitable chain in the environment, the injected object has no actionable consequence; with one present, an attacker could achieve arbitrary file deletion, information disclosure, or remote code execution.

Business impact

For WordPress site operators, this vulnerability presents a conditional but potentially serious risk. Organizations running LearnPress on multi-plugin environments should assess whether companion plugins or themes introduce known POP gadgets. If no such gadgets exist, the immediate risk is low. However, if vulnerable chains are present, an administrator account compromise becomes a vector for full system compromise. The attack surface is limited to authenticated administrators, reducing overall organizational risk but requiring strong access controls and monitoring of administrator actions.

Affected systems

LearnPress – Backup & Migration Tool plugin in all versions up to and including 4.1.4 running on WordPress installations. The vulnerability requires administrator-level or higher access to trigger. Impact depends on the presence of additional vulnerable plugins or themes with POP chains in the same WordPress environment.

Exploitability

Exploitation requires authentication with administrator-level privileges or above, placing a high barrier to attack. The attacker must already have administrative access to craft and inject the malicious object. Practical impact is further constrained by the absence of a known POP chain within LearnPress itself; a separate vulnerable plugin or theme must be installed for the injection to have any observable effect. Overall exploitability is moderate—the access requirement is restrictive, but the attack is straightforward once prerequisites are met.

Remediation

Update LearnPress – Backup & Migration Tool to a version beyond 4.1.4 as soon as patched versions are available. Audit all installed plugins and themes for known POP chains or gadget chains that could amplify this vulnerability. Implement strict access controls on administrator accounts, use Web Application Firewalls (WAF) with serialization detection rules, and monitor WordPress core logging for suspicious admin actions or object injection attempts. Consider disabling or removing the plugin if it is not actively used.

Patch guidance

Verify that the plugin vendor has released a patched version beyond 4.1.4. Once available, apply the patch during a maintenance window and test thoroughly in a staging environment before production deployment. If no patch has been released, consider alternative backup and migration solutions or deactivate the plugin until remediation is available. Check the vendor's advisory channel directly for patch release timelines.

Detection guidance

Monitor WordPress debug logs and security plugins for deserialization warnings or suspicious object injection attempts. Audit administrator action logs for unexpected plugin or theme configuration changes. Deploy WordPress-focused security tools capable of detecting serialized object injection patterns in POST requests targeting the plugin's endpoints. Network-level detection is challenging without WAF rules configured to flag serialization attacks. Regularly scan installed plugins and themes against known gadget chain databases to assess environmental risk.

Why prioritize this

Although rated MEDIUM (CVSS 6.6), this vulnerability should be prioritized based on your installed plugin ecosystem. Environments with numerous plugins face higher risk if POP chains exist. However, organizations running minimal plugins or using hardened WordPress configurations may deprioritize remediation if no vulnerable companion plugins are identified. Authentication requirement and dependency on external gadgets reduce urgency compared to critical unauthenticated RCE flaws, but the conditional nature means risk assessment must account for your specific setup.

Risk score, explained

The CVSS 3.1 score of 6.6 (MEDIUM) reflects high potential impact (confidentiality, integrity, availability all scored HIGH) but is moderated by high attack complexity (AC:H) and requirement for high-privilege authentication (PR:H). The score assumes a POP chain is present; in environments where no gadget chain exists, practical risk is lower. The score is not an absolute risk rating for your environment—it is a generic baseline that requires contextualization based on your plugin inventory and administrator account security posture.

Frequently asked questions