CVE-2026-7566

An authenticated attacker with administrator-level access can exploit this vulnerability by uploading a malicious backup file. This file, when processed by the plugin, can lead to the deserialization of untrusted input. If a suitable POP chain is present in another installed plugin or theme, the attacker can achieve arbitrary file deletion, sensitive data retrieval, or code execution.

The vulnerability lies within the LearnPress – Backup & Migration Tool plugin for WordPress. Specifically, the import functionality, which processes uploaded backup files, is susceptible to this issue. The code responsible for parsing and deserializing the import file data is the primary area of concern.

The patch is not available in the provided information. The advisory recommends that users update to a version that addresses this vulnerability. Without a patch, the exact remediation steps are not specified, but typically involve sanitizing or validating serialized data before deserialization.