CVE-2026-12971

Name of the Vulnerable Software and Affected Versions LearnPress WordPress plugin versions prior to 4.4.4

Description Users with the instructor role can induce the server to issue requests to arbitrary external hosts because the plugin fails to validate a user-supplied URL before the server fetches it. This leads to a blind and bounded server-side request forgery (SSRF), a condition where the server is tricked into making requests to an unintended location, but the response is not returned to the attacker and the request is limited in scope.

Recommendations Update LearnPress WordPress plugin to version 4.4.4 or later.