CVE-2026-39728: CWE-918 Server-Side Request Forgery (SSRF) in instapagedev Instapage Plugin

CVE-2026-39728 is an unauthenticated SSRF vulnerability in the Instapage Plugin (instapagedev) affecting versions up to 3.7.2. SSRF vulnerabilities allow attackers to make the vulnerable server perform HTTP requests to arbitrary URLs, potentially accessing internal resources or services. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, scope changed, and partial impact on confidentiality and integrity. No vendor advisory or patch information is available at this time.

The vulnerability allows unauthenticated attackers to cause the server running the Instapage Plugin to make arbitrary HTTP requests. This can lead to partial confidentiality and integrity impacts, such as accessing internal resources or manipulating data. There is no indication of availability impact or known active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, consider restricting outbound HTTP requests from the server hosting the plugin or applying network-level controls to limit SSRF exploitation.