The instapagedev Instapage Plugin version 3.7.0 and earlier contains a CSRF vulnerability that could allow attackers to perform unauthorized actions by exploiting the trust of an authenticated user. The vulnerability does not require privileges or elevated access and involves user interaction. The CVSS vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, low integrity impact, and no availability impact.

Successful exploitation of this CSRF vulnerability could allow an attacker to cause limited integrity impact by tricking a user into submitting unauthorized requests to the Instapage Plugin. There is no confidentiality or availability impact reported. No known exploits are currently observed in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor the vendor's communications for updates. In the meantime, applying general CSRF mitigations such as ensuring anti-CSRF tokens and validating request origins may reduce risk, but specific guidance should come from the vendor.