CVE-2026-39571
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
The WordPress plugin Instantio (instantio) by Themefic has a vulnerability that exposes sensitive system information to unauthorized control spheres, allowing retrieval of embedded sensitive data. This affects versions up to and including 3.3.30.
Risk Assessment
An attacker may gain access to sensitive system data such as server configuration or credentials, potentially facilitating further attacks.
Recommendation
Update the Instantio plugin to a version above 3.3.30 if a patch is available, or restrict access to sensitive information.
Original NVD description (English source)
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Themefic Instantio instantio allows Retrieve Embedded Sensitive Data.This issue affects Instantio: from n/a through <= 3.3.30.