Exploit discussion active in current signal (2 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
The Instant Appointment plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'insapp_upload_image_as_attachment' function in all versions up to, and including, 1.2. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
NONE
🚨 CVE-2026-15282 — CVSS 9.8/10 ██████████ The Instant Appointment plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type... Severity: CRITICAL Patch now. #cybersecurity #CVE https://t.co/mhKwQx9jJl
Post summary
A critical vulnerability in the Instant Appointment WordPress plugin enables arbitrary file uploads; a patch is available and urged.
🚨 CRITICAL: WordPress 3-Plugin File Upload Wave — CVSS 9.8 x2 Super Forms (CVE-2026-14894): Unauthenticated file upload via submit_form Instant Appointment (CVE-2026-15282): Unauthenticated file upload → http://threataft.com/articles/wordpress-plugins-super-forms-instant-appointment-post-export-import-file-upload #cybersecurity #infosec #WordPress
Post summary
Two WordPress plugins (Super Forms and Instant Appointment) are disclosed as critically vulnerable to unauthenticated file upload (CVSS 9.8), with no patches or active exploitation reported.