EUVD-2026-55024
GHSA-w229-45jg-vp35
Severity by source
AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N
Instructor role required (PR:H) and specific feature interaction needed (AC:H); only blind outbound traffic possible, yielding limited confidentiality impact (C:L) with no integrity or availability effect.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The LearnPress WordPress plugin before 4.4.4 does not validate a user-supplied URL before the server fetches it, allowing users with the instructor role to induce the server to issue requests to arbitrary external hosts, a blind and bounded server-side request forgery.
AnalysisAI
LearnPress WordPress plugin before version 4.4.4 exposes a blind, bounded server-side request forgery (SSRF) exploitable by users holding the instructor role, allowing the WordPress server to issue HTTP requests to arbitrary external hosts chosen by the attacker. Reported by WPScan and tracked under CWE-918, the flaw stems from absent URL validation on a user-controllable input. A public proof-of-concept exists; however, EPSS at 0.14% (4th percentile) and the absence of a CISA KEV listing indicate negligible observed exploitation activity, consistent with the high-privilege requirement.
Technical ContextAI
LearnPress is a WordPress LMS plugin that implements server-side URL fetching for instructor-facing functionality - likely for importing remote course content or media. The vulnerable code path accepts a URL supplied by an authenticated instructor and forwards it directly to a server-side HTTP client (typically PHP's wp_remote_get or curl) without allowlisting permitted hosts or schemes. CWE-918 (Server-Side Request Forgery) describes this root cause: the server is coerced into acting as a proxy for attacker-controlled destinations. The 'blind' qualifier means the HTTP response body is not reflected back to the attacker, and 'bounded' suggests the request type or headers are constrained, limiting the exfiltration channel. Affected CPE is cpe:2.3:a:unknown:learnpress:*:*:*:*:*:*:*:*, covering all versions of the plugin prior to 4.4.4.
RemediationAI
The primary fix is to upgrade LearnPress to version 4.4.4 or later, as confirmed by the WPScan advisory (https://wpscan.com/vulnerability/ef69bd9d-ec2a-4526-b2b9-51948fa76980/) and the EUVD-2026-55024 record. If an immediate upgrade is not feasible, defenders should audit all WordPress users assigned the instructor role and reduce that set to only trusted accounts, since the attack requires instructor-level authentication. As a compensating control, outbound HTTP requests from the WordPress server can be blocked or restricted at the network perimeter or WAF level to prevent the server from reaching internal network ranges (RFC-1918 addresses, cloud metadata endpoints such as 169.254.169.254). This network-level block trades off any legitimate instructor URL-fetch functionality but eliminates the SSRF pivot path. Monitoring outbound traffic from the web server for unusual internal-host destinations can serve as a detection control while patching is scheduled.
More in Learnpress
View allSQL injection in LearnPress LMS plugin for WordPress (versions ≤ 4.2.7) allows unauthenticated remote attackers to injec
The LearnPress plugin for WordPress is vulnerable to Command Injection in all versions up to, and including, 4.2.5.7 via
The LearnPress plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order_by’ parameter in all versio
SQL injection in the LearnPress LMS plugin for WordPress (versions up to and including 4.2.6.5) allows remote unauthenti
The LearnPress - WordPress LMS Plugin plugin for WordPress is vulnerable to SQL Injection via the 'c_fields' parameter o
The LearnPress WordPress plugin before 4.1.4 does not sanitise, validate and escape the id parameter before using it in
Unauthorized access to paid course content in LearnPress WordPress plugin (all versions before 4.4.4) allows any authent
LearnPress Wordpress plugin version prior and including 3.2.6.7 is vulnerable to SQL Injection. Rated high severity (CVS
The LearnPress WordPress plugin before 4.1.7.2 unserialises user input in a REST API endpoint available to unauthenticat
The LearnPress - WordPress LMS Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versio
Reflected Cross-Site Scripting in the LearnPress WordPress plugin before 4.4.1 lets a remote attacker execute arbitrary
The LearnPress - WordPress LMS Plugin plugin for WordPress is vulnerable to arbitrary file uploads due to missing file t
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today