CVE-2026-12971
LowCVSS 2.2Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
The LearnPress WordPress plugin before version 4.4.4 does not validate a user-supplied URL before the server fetches it, allowing users with the instructor role to induce the server to issue requests to arbitrary external hosts, a blind and bounded server-side request forgery.
Risk Assessment
Instructors could use the server to scan the internal network or attack external systems, potentially leading to data leakage or security breaches.
Recommendation
Update the LearnPress plugin to version 4.4.4 or later, which includes URL validation fixes.
Other vulnerabilities in LearnPress WordPress plugin
See all- CVE-2026-86446Low
The LearnPress WordPress plugin before 4.4.7 does not restrict the correctness flags it returns when a quiz answer is checked, allowing unauthenticated attackers to obtain the correct answer to every option of a question, along with the instructor's explanation, on courses configured to be taken without enrolling.
- CVE-2026-78125Medium
The LearnPress WordPress plugin before 4.0.3 does not perform any authorization check on one of its REST endpoints in all versions up to, and including, 4.0.2, allowing unauthenticated attackers to disclose the payment status of arbitrary orders by enumerating order identifiers.
- CVE-2026-8383Medium
The LearnPress WordPress plugin before version 4.3.7 does not gate the `edit` context on one of its REST endpoints, allowing unauthenticated users to retrieve user roles, full capabilities map, extra capabilities, locale, and registration date via a crafted request.
Original NVD description (English source)
The LearnPress WordPress plugin before 4.4.4 does not validate a user-supplied URL before the server fetches it, allowing users with the instructor role to induce the server to issue requests to arbitrary external hosts, a blind and bounded server-side request forgery.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS