CVE-2026-39728

instapagedev Instapage Plugin

Published 6 Oct 2026 · updated 6 Oct 2026 · Deferred

7.2 High · CVSS 3.1, patchstack.com

Description

Unauthenticated Server Side Request Forgery (SSRF) in Instapage Plugin <= 3.7.2 versions.

References

patchstack.com/database/wordpress/plugin/instapage/vulnerability/wordpress-instapage-plugin-plugin-3-7-2-server-side-request-forgery-ssrf-vulnerability?_s_id=cve