CVE-2026-12971: The LearnPress WordPress plugin before 4.4.4 does not validate a user-supplied URL before the server fetches it, allowi

CVE-2026-12971 is a vulnerability in the LearnPress WordPress plugin (a learning management system plugin) before version 4.4.4 where the server doesn't check if URLs are safe before fetching them. This allows instructors to trick the server into making requests to any external website, which is called SSRF (server-side request forgery, where an attacker makes a server send requests on their behalf).