LearnPress WordPress plugin versions earlier than 4.4.4 do not validate a user‑supplied URL before the server retrieves it. This omission allows users with the instructor role to trigger the plugin to make requests to arbitrary external hosts. The vulnerability is a blind, bounded server‑side request forgery, which could be exploited to probe internal network services, exfiltrate data, or potentially reach other vulnerable systems that the server can reach. The impact is the attacker gains the ability to cause the server to perform outbound requests, potentially leading to disclosure or manipulation of sensitive information.

Any WordPress installation using LearnPress plugin prior to 4.4.4 is affected. The vulnerability requires the attacker to have the instructor role or equivalent capability within the plugin. The scope is limited to the impacted server and the external hosts it can reach, but the lack of validation allows indirect access to internal resources.

The vulnerability is a server‑side request forgery (CWE‑918). Because the request is blind, the attacker cannot observe responses, yet the bounded nature of the request means the server may be limited to certain domains or hostnames, reducing but not eliminating risk. EPSS data is not available, and the vulnerability is not listed in CISA KEV, but the lack of input validation combined with the ability to target arbitrary hosts suggests a significant exploitation risk if an instructor account is compromised or if policy allows them to submit arbitrary URLs. The potential for internal system reconnaissance and data exfiltration warrants prompt remediation.