What is the CVSS score of CVE-2026-39571?

CVE-2026-39571 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Instantio CVE-2026-39571

Q: Which versions of Instantio are affected by CVE-2026-39571?

Themefic Instantio WordPress plugin versions up to 3.3.30 expose sensitive system information to unauthenticated remote attackers via an unspecified mechanism that retrieves embedded sensitive data.

EUVD-2026-20219 MEDIUM

Exposure of Sensitive System Information to an Unauthorized Control Sphere (CWE-497)

2026-04-08 Patchstack

GHSA-45jv-8hvx-m25c

Information Disclosure Instantio

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 15, 2026 - 12:41 vuln.today

CVSS changed

Apr 13, 2026 - 16:22 NVD

5.3 (MEDIUM)

EUVD ID Assigned

Apr 08, 2026 - 08:45 euvd

EUVD-2026-20219

CVE Published

Apr 08, 2026 - 08:30 nvd

N/A

DescriptionCVE.org

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Themefic Instantio instantio allows Retrieve Embedded Sensitive Data.This issue affects Instantio: from n/a through <= 3.3.30.

AnalysisAI

Themefic Instantio WordPress plugin versions up to 3.3.30 expose sensitive system information to unauthenticated remote attackers via an unspecified mechanism that retrieves embedded sensitive data. The vulnerability has a CVSS score of 5.3 with no authentication required and low complexity, enabling confidentiality compromise without requiring user interaction. No public exploit code or active exploitation has been confirmed, and the EPSS score of 0.02% indicates minimal real-world exploitation probability despite the direct remote accessibility.

Technical ContextAI

Themefic Instantio is a WordPress plugin (CPE: cpe:2.3:a:themefic:instantio:*:*:*:*:*:*:*:*) that appears to embed sensitive system information in a manner accessible to unauthenticated users. CWE-497 (Exposure of Sensitive System Information to an Unauthorized Control Sphere) classifies vulnerabilities where sensitive information is disclosed to unauthorized parties due to improper access controls or data exposure mechanisms. The root cause involves inadequate protection of sensitive data fields-such as configuration details, API keys, system paths, or internal identifiers-that should be restricted to authenticated administrators but are instead retrievable through normal plugin API endpoints or template outputs accessible to any network-connected user.

RemediationAI

Update Themefic Instantio to the first patched version released after 3.3.30; consult the official WordPress plugin repository or Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/instantio/vulnerability/wordpress-instantio-plugin-3-3-30-sensitive-data-exposure-vulnerability) for exact version number and release date. If a patched version is not immediately available, disable the plugin temporarily or restrict access to the WordPress installation via web application firewall rules blocking requests to plugin endpoints from untrusted sources. No workarounds are documented; update to the latest available version as soon as the vendor releases a fix.