CVE-2026-39728

HighCVSS 7.2

Published: 06/10/2026(UTC)Updated: 06/10/2026(UTC)Translated: 06/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.26%

16th percentile - higher than 16% of all known CVEs

Summary

A vulnerability in the Instapage Plugin up to version 3.7.2 allows an unauthenticated attacker to perform a Server Side Request Forgery (SSRF) attack.

Risk Assessment

An unauthenticated attacker can send requests to internal network resources, potentially leading to data disclosure, attacks on internal services, or privilege escalation.

Recommendation

Update the Instapage Plugin to the latest version that includes a fix for this vulnerability.

Other vulnerabilities in Instapage Plugin

CVE-2025-60115Medium
CSRF vulnerability in the Instapage plugin. Allows an attacker to perform unauthorized requests on behalf of an administrator.

Original NVD description (English source)

Unauthenticated Server Side Request Forgery (SSRF) in Instapage Plugin <= 3.7.2 versions.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS