CVE-2026-15282
CRITICALInstant Appointment <= 1.2 - Unauthenticated Arbitrary File Upload
Title source: cnaExploitation Summary
EIP tracks 1 public exploit for CVE-2026-15282. PoCs published by shinthink.
AI-analyzed exploit summary This exploit targets CVE-2026-15282, a pre-authentication arbitrary file upload vulnerability in the Instant Appointment WordPress plugin (≤1.2). The exploit leverages unauthenticated AJAX action `add_service_front` to upload a PHP webshell via `file_get_contents()` and `file_put_contents()` with attacker-controlled `image_url` and `image_name` parameters, leading to remote code execution.
Description
The Instant Appointment plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'insapp_upload_image_as_attachment' function in all versions up to, and including, 1.2. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
Exploits (1)
This exploit targets CVE-2026-15282, a pre-authentication arbitrary file upload vulnerability in the Instant Appointment WordPress plugin (≤1.2). The exploit leverages unauthenticated AJAX action `add_service_front` to upload a PHP webshell via `file_get_contents()` and `file_put_contents()` with attacker-controlled `image_url` and `image_name` parameters, leading to remote code execution.
References (4)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H