EUVD-2026-93250
GHSA-f9x9-mxcq-hx6w
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach plugin HTTP endpoint remotely
-
DeliverySubmit crafted URL parameter
-
ExploitServer issues forged outbound request
-
ExecutionPivot to internal/metadata service
-
ImpactExfiltrate limited response data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V4 - API and Web Service URL allowlisting, SSRF prevention
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Credential Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No authentication required - the supplied CVSS vector (PR:N/UI:N) indicates an unauthenticated, no-user-interaction attack reachable over the network against WordPress sites running the Instapage plugin version 3.7.2 or earlier. The specific vulnerable feature/endpoint is not named in the description; the limiting factors are that the Instapage plugin must be installed and active and running a version <= 3.7.2, and practical impact depends on what internal services or metadata endpoints are reachable from the web server (impact is rated Low confidentiality/Low integrity, implying constrained rather than full response retrieval). Upgrading past 3.7.2 removes the condition. |
| Impact | This is a medium-to-high severity, lower-urgency issue. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, base 7.2) describes a network-reachable, low-complexity, unauthenticated flaw with a scope change but only Low confidentiality and Low integrity impact and no availability impact - consistent with a classic SSRF (CWE-918) rather than direct remote code execution. No EPSS score, CISA KEV listing, or public proof-of-concept was supplied in the intelligence, so there is no public exploit identified at time of analysis and no evidence of active exploitation. An SSRF with no authentication is attractive for pivoting into internal networks and cloud metadata endpoints, which justifies patching, but the absence of exploitation signals and the Low/Low impact rating place it below actively-exploited RCE-class bugs in priority. Note the single-source nature of this data: the only reference is the Patchstack advisory, and NVD-style enrichment (EPSS, KEV, independent CVSS) is absent, so exploitation probability cannot be quantified from the provided data. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker sends a crafted HTTP request to a vulnerable endpoint of the Instapage WordPress plugin (<= 3.7.2), coercing the server to issue attacker-controlled outbound requests. This can be abused to reach internal-only services or cloud instance metadata (e.g., 169.254.169.254) and read limited responses. No public proof-of-concept is referenced; given AV:N/AC:L/PR:N/UI:N, exploitation requires only network access with no authentication or user interaction. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 06, 2026
Unauthenticated server-side request forgery in the Instapage WordPress plugin, affecting all versions up to and including 3.7.2, lets any remote attacker who can reach a vulnerable site make the web server issue requests to arbitrary internal or external destinations. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, base 7.2) confirms the attack is network-reachable, requires no credentials and no user interaction, and crosses a security scope boundary, though the Low confidentiality and Low integrity ratings indicate constrained response retrieval and limited write effects rather than full data exfiltration. No public exploit code or in-the-wild exploitation has been identified at time of analysis, and no EPSS or KEV data was supplied; this is a medium-to-high severity, lower-urgency issue whose practical impact depends on what internal services, cloud metadata endpoints, or trusted-network resources are reachable from the affected web server.
RemediationAI
The primary fix is to update the Instapage WordPress plugin past version 3.7.2 - since 3.7.2 and all earlier releases are affected, installing the latest available release removes the vulnerable code path; no vendor-published patched version number beyond the '<= 3.7.2' affected range was provided in the available data, so confirm the fixed release on the plugin's WordPress.org page or the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/instapage/vulnerability/wordpress-instapage-plugin-plugin-3-7-2-server-side-request-forgery-ssrf-vulnerability?_s_id=cve) before deploying. If immediate updating is not possible, compensating controls are: deactivate and remove the Instapage plugin if it is not actively used, accepting the loss of its landing-page functionality; apply egress filtering on the web server so that PHP cannot initiate outbound connections to private, loopback, and link-local ranges such as 169.254.169.254 and 10.0.0.0/8, with the trade-off that legitimate plugin or site integrations calling internal services may break; enforce an IMDSv2-only or metadata-service firewall posture on cloud hosts so forged metadata requests fail even if SSRF succeeds, accepting that this is a hosting-level change outside the plugin; and deploy WAF rules that block requests carrying internal-style URL parameters to the plugin's endpoints, understanding that WAF matching is heuristic and may both miss bypasses and flag legitimate traffic.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a classic server-side request forgery (SSRF) instance, mapped to CWE-918, inside the Instapage WordPress plugin's server-side request handling. SSRF of this class arises when plugin code accepts an attacker-supplied URL parameter - typically a remote-fetch, image/asset import, webhook, or API-proxy style function - and passes it to a server-side HTTP client (WordPress's wp_remote_get/wp_remote_post or cURL) without validating the destination against an allowlist or blocking private, loopback, and link-local address ranges. Because the CVSS vector carries PR:N and UI:N, the exploitable code path is reachable without a WordPress account and without tricking an administrator into clicking anything, and the S:C scope change reflects that the forged request escapes the vulnerable component's security authority and reaches third-party systems - most importantly cloud instance metadata services (169.254.169.254), internal admin panels, or intranet APIs. The CPE cpe:2.3:a:instapagedev:instapage_plugin:*:*:*:*:*:*:*:* with the '<= 3.7.2' version bound identifies the affected artifact as the Instapage WordPress plugin distributed through the WordPress.org/Instapage ecosystem; because WordPress plugins execute inside the same PHP process as the site, an SSRF here inherits the hosting environment's network position, and the Low confidentiality impact corresponds to constrained or partial retrieval of responses rather than a full blind-read primitive. The report originates from Patchstack's WordPress vulnerability database.
Know when Instapage Plugin gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Unauthenticated network SSRF (PR:N/AV:N/AC:L); scope changes (S:C) as the server reaches other systems, with limited Low read/write impact and no availability effect.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated Server Side Request Forgery (SSRF) in Instapage Plugin <= 3.7.2 versions.
Executive ViewAI
The Instapage WordPress plugin, used across all versions up to 3.7.2, contains an unauthenticated server-side request forgery vulnerability that allows any remote attacker to force the hosting web server to make requests to internal or external resources. With no vendor-released patch identified at time of analysis, organizations running this plugin face potential exposure of internal services, cloud metadata, or trusted network resources, though the practical impact is constrained by limited data retrieval and write effects. Leadership should prioritize mitigation because the flaw is remotely exploitable without credentials, but no public exploit identified at time of analysis.
No vendor-released patch identified at time of analysis. Interim mitigations include disabling or removing the Instapage plugin, restricting outbound network traffic from the web server to only necessary destinations, blocking access to cloud metadata endpoints (e.g., 169.254.169.254), using a web application firewall with SSRF detection rules, and monitoring for unauthorized outbound requests.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Server-Side Request Forgery exploits applications that fetch remote resources based on user-supplied URLs.
Exploit-DB