LearnPress CVE-2026-12971

Exploitation requires an authenticated WordPress session with the LearnPress instructor role - this is not the default WordPress subscriber or contributor role, but a LearnPress-specific role granted to course creators. The CVSS vector PR:H and AC:H confirm that both elevated privilege and non-trivial conditions must be satisfied. The SSRF output is blind and bounded, meaning an attacker cannot read response content directly and the request behavior may be constrained by server-side HTTP client configuration (e.g., redirect limits, timeout, allowed schemes). Exploitation is further limited to sites where LearnPress is actively installed, enabled, and has instructor-role users. Unauthenticated exploitation is not possible. Sites that do not assign the instructor role to untrusted external users face no realistic threat.

The composite risk picture is consistently low across all available signals. The NVD CVSS base score of 2.2 with vector CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N reflects the two primary dampening factors: high attack complexity and high privilege requirement (instructor role). EPSS at 0.14% places this vulnerability in the 4th percentile of expected exploitation probability, confirming minimal interest from threat actors. No CISA KEV listing exists, meaning active in-the-wild exploitation is not confirmed by U.S. federal threat intelligence. A public POC does exist per WPScan, which is the only escalating signal - but POC availability without observed exploitation in a high-PR scenario typically indicates the barrier to mass abuse remains the credentialed access requirement. SSVC exploitation status is 'none detected.' This is a genuine low-priority issue: real-world impact is bounded by the need to first compromise or possess an instructor account, and even then the SSRF yields only limited blind outbound traffic, not direct code execution or credential theft.

An attacker who holds or has compromised an instructor account on a target WordPress site submits a crafted URL - for example, pointing to an internal cloud metadata endpoint such as http://169.254.254.169/latest/meta-data/ - through the LearnPress instructor interface. The WordPress server fetches the URL server-side; because the SSRF is blind, the attacker cannot directly read the response, but can infer host reachability through timing differences or error states. A public POC is available via WPScan, lowering the technical bar for any attacker who already possesses instructor credentials.