The LearnPress WordPress plugin versions prior to 4.4.4 contain a server-side request forgery (SSRF) vulnerability (CWE-918) where the plugin does not validate user-supplied URLs before the server issues HTTP requests. Users with the instructor role can exploit this to induce the server to make requests to arbitrary external hosts. The vulnerability is blind and bounded, limiting the attacker's ability to directly observe the response. There is no CVSS score or vendor advisory indicating a patch or fix at this time.

An attacker with instructor privileges can cause the server to make HTTP requests to arbitrary external hosts. This could potentially be used to access internal resources or services not otherwise accessible, but the attack is blind and bounded, limiting direct data exfiltration or interaction. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict instructor role permissions to trusted users only and monitor for suspicious activity related to URL inputs in LearnPress.