CVE-2026-12971: LearnPress WordPress Plugin SSRF Vulnerability
The LearnPress WordPress plugin before version 4.4.4 is vulnerable to a blind and bounded server-side request forgery (SSRF) attack. This vulnerability allows users with the instructor role to induce the server to issue requests to arbitrary external hosts. The vulnerability has not been actively exploited but poses a significant risk due to its potential for abuse. Organizations using affected versions of the LearnPress plugin should upgrade to version 4.4.4 or later immediately.