CVE-2026-12971 is a CWE-918 SSRF vulnerability in the LearnPress WordPress plugin prior to version 4.4.4. The plugin fails to validate user-supplied URLs before the server issues HTTP requests, allowing authenticated users with the instructor role to induce the server to make requests to arbitrary external hosts. This is a blind and bounded SSRF, meaning the attacker cannot see the response directly and the scope of the requests is limited. The vulnerability has a low severity rating with a CVSS 3.1 base score of 2.2 (Network attack vector, high attack complexity, requires high privileges, no user interaction, unchanged scope, low confidentiality impact, no integrity or availability impact). No patch or official fix has been confirmed in the provided data.

The impact is limited to low confidentiality loss due to the SSRF vulnerability. Because the attacker must have the instructor role, which is a privileged role, the attack surface is restricted. There is no reported impact on integrity or availability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict instructor role assignments to trusted users only and monitor for unusual server request activity related to LearnPress. Avoid exposing the plugin to untrusted users with elevated privileges.