Unauthenticated server‑side request forgery (SSRF) is present in Instapage Plugin versions 3.7.2 and earlier. The flaw allows an unauthenticated attacker to instruct the WordPress site to make HTTP requests to arbitrary destinations, potentially exposing internal network services, secrets, or facilitating data exfiltration. The vulnerability is a classic injection of outbound requests and can be used to discover or manipulate resources that would otherwise be protected by network isolation.

The vulnerability affects the Instapage WordPress plugin released by Instapage Developer (instapagedev). Versions up to and including 3.7.2 are impacted. No specific sub‑versions are listed; any release within the 3.7.x series prior to the notice is at risk.

The CVSS score of 7.2 indicates a high severity, and while the EPSS score of 0.00255 indicates a very low probability of exploitation, the lack of KEV listing does not diminish the potential for exploitation. Attackers can exploit the flaw by sending a crafted request to the plugin’s SSRF endpoint without authentication, yielding remote access to internal or external resources. Systems with unrestricted outbound connectivity or weak firewall controls are especially susceptible.