CVE-2026-15282
Received Received - Intake

Arbitrary File Upload in Instant Appointment WordPress Plugin

Publication date: 2026-07-10

Last updated on: 2026-07-10

Assigner: Wordfence

Description
The Instant Appointment plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'insapp_upload_image_as_attachment' function in all versions up to, and including, 1.2. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-10
Last Modified
2026-07-10
Generated
2026-07-10
AI Q&A
2026-07-10
EPSS Evaluated
N/A
NVD
CVE-2026-15282
EUVD
EUVD-2026-42790

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
instant_appointment plugin to 1.2 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-434 The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Instant Appointment plugin for WordPress has a vulnerability in the 'insapp_upload_image_as_attachment' function where it does not properly validate the type of files being uploaded.

This lack of file type validation allows unauthenticated attackers to upload arbitrary files to the affected website's server.

Because attackers can upload any file, this may enable them to execute remote code on the server.

Impact Analysis

This vulnerability can have severe impacts including unauthorized remote code execution on your server.

An attacker could gain control over your website or server by uploading malicious files.

This could lead to data breaches, defacement of your website, or use of your server for malicious activities.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-15282. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart