Aller au contenu
Se connecter
9.8 Critique

CVE-2026-15282 The Instant Appointment plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation…

Description

The Instant Appointment plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'insapp_upload_image_as_attachment' function in all versions up to, and including, 1.2. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.

Produits et versions touchés

Produit Versions touchées Corrigé en
Instant Appointment 1.2 premières → 1.2 Pas de correctif indiqué

Autres CVE de Instant Appointment

Les 3 CVE de Instant Appointment →
CVE-2025-23672 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tenteeglobal… 7.1 Élevée CVE-2024-54361 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in tenteeglobal… 9.3 Critique
Suivre cette CVE