Skip to content
Sign in
9.8 Critical

CVE-2026-15282 The Instant Appointment plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation…

Description

The Instant Appointment plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'insapp_upload_image_as_attachment' function in all versions up to, and including, 1.2. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.

Affected products and versions

Product Affected versions Fixed in
Instant Appointment 1.2 earliest → 1.2 No fix stated

Other CVEs of Instant Appointment

The 3 CVEs of Instant Appointment →
CVE-2025-23672 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tenteeglobal… 7.1 High CVE-2024-54361 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in tenteeglobal… 9.3 Critical
Track this CVE