CVE-2026-12971 — LearnPress < 4.4.4 - Instructor+ Server-Side Request Forgery via openai_apply_image_feature
The LearnPress WordPress plugin before 4.4.4 does not validate a user-supplied URL before the server fetches it, allowing users with the instructor role to induce the server to…
Published: 2026-08-10 · CVSS: 2.2 · CVSS 3.1
The LearnPress WordPress plugin before 4.4.4 does not validate a user-supplied URL before the server fetches it, allowing users with the instructor role to induce the server to issue requests to arbitrary external hosts, a blind and bounded server-side request forgery.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7