CVE-2026-12971 LearnPress CVE debrief

Who should care

Users of LearnPress plugin, especially those with instructor roles, should verify their plugin version and take necessary precautions. Additionally, security teams and vulnerability management teams should be aware of this vulnerability and review their environments for potential exposure. Platform operators and administrators should also be aware of this vulnerability and take steps to mitigate it.

Technical summary

The LearnPress WordPress plugin before 4.4.4 is vulnerable to server-side request forgery due to lack of validation on user-supplied URLs. This vulnerability allows users with the instructor role to potentially induce the server to make requests to external hosts, which could lead to information disclosure or other unintended consequences. The vulnerability is considered a blind and bounded server-side request forgery.

Defensive priority

Verify LearnPress plugin version and restrict instructor role permissions.

Recommended defensive actions

• Verify LearnPress plugin version
• Restrict instructor role permissions
• Monitor for suspicious requests
• Review compensating controls for exposed systems
• Check relevant monitoring, detection, and logs for exposed assets
• Track exceptions and retest remediated assets
• Confirm whether affected product deployments exist in managed environments

Evidence notes

The LearnPress WordPress plugin before 4.4.4 does not validate a user-supplied URL before the server fetches it, allowing users with the instructor role to induce the server to issue requests to arbitrary external hosts, a blind and bounded server-side request forgery. Evidence from WPScan indicates a vulnerability in LearnPress plugin before version 4.4.4. The vulnerability allows users with instructor roles to potentially induce the server to make requests to external hosts, which could lead to information disclosure or other unintended consequences. Defenders should verify their LearnPress plugin version, restrict instructor role permissions, and monitor for suspicious requests.

Official resources