CVE-2026-12971

The LearnPress WordPress plugin (versions prior to 4.4.4 ) is vulnerable to a blind and bounded server-side request forgery (SSRF) . The root cause is a lack of validation for user-supplied URLs before the server attempts to fetch them, specifically within the openai_apply_image_feature functiona...

CVE-2026-12971 LearnPress < 4.4.4 - Instructor+ Server-Side Request Forgery via openai_apply_image_feature

The LearnPress WordPress plugin before 4.4.4 does not validate a user-supplied URL before the server fetches it, allowing users with the instructor role to induce the server to issue requests to arbitrary external hosts, a blind and bounded server-side request forgery...