CRITICALVulnerability
Verified
Global

NVD CRITICAL: CVE-2026-15282 — The Instant Appointment plugin for WordPress is vulnerable to arbitrary file upl...

·Source: NIST NVD

Updated:

Executive Summary

The Instant Appointment plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'insapp_upload_image_as_attachment' function in all versions up to, and including, 1.2. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.

Analysis

The Instant Appointment plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'insapp_upload_image_as_attachment' function in all versions up to, and including, 1.2. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. CVSS Score: 9.8. Published: 2026-07-10T05:16:30.820.

Indicators of Compromise (1)

CVE (1)
CVE-2026-15282
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Jul 10, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerabilityNEW

Siam Commercial Bank selects Citi's token clearing service

The Siam Commercial Bank (SCB) and Citi announce SCB as the first financial institution client globally to go live with Citi’s newly integrated 24/7 USD Clearing and Citi Token Services solution.

Finextra
CRITICALVulnerability

NVD CRITICAL: CVE-2026-15300 — The GEO my WP plugin for WordPress was vulnerable to SQL Injection via the 'dist...

The GEO my WP plugin for WordPress was vulnerable to SQL Injection via the 'distance', 'lat', and 'lng' parameters in versions up to, and including, 4.5.4. The values were read from $_SERVER['QUERY_STRING'] via parse_str() (bypassing wp_magic_quotes, which does not cover $_SERVER), then passed through bare esc_sql() before being interpolated into unquoted numeric positions in the proximity-search

CVE-2026-15300
NIST NVD
CRITICALVulnerability

NVD CRITICAL: CVE-2026-14894 — The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to...

The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 6.3.313 via the submit_form function. This is due to missing file type validation and the absence of any capability check on the submit_form nopriv AJAX handler, whose only barrier is a session nonce freely obtainable by unauthenticated visitors via a separat

CVE-2026-14894
NIST NVD