Security readout for executives and security teams
Plain-English summary
CVE-2026-15282 affects the Instant Appointment WordPress plugin through version 1.2. A missing file type check can let unauthenticated internet users upload arbitrary files to the server. The CVSS score is 9.8, and remote code execution may be possible, so exposed sites should be treated as high priority.
Executive priority
Prioritize within emergency patch or containment workflows for any public site using this plugin. If the business cannot immediately confirm a safe version or vendor fix, disabling the plugin is the clearest short-term risk reduction.
Technical view
The issue is CWE-434 in the insapp_upload_image_as_attachment function. Sources state missing file type validation allows unauthenticated arbitrary file upload in Instant Appointment <= 1.2. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Public references include Wordfence and WordPress plugin Trac code locations.
Likely exposure
Public WordPress sites running Instant Appointment up to and including version 1.2 are the likely exposure. Because no authentication or user interaction is required, any internet-reachable affected site should be considered at risk.
Exploitation context
The source bundle does not show CISA KEV listing or cited evidence of active exploitation. However, the vulnerability is network-accessible, unauthenticated, low complexity, and may enable remote code execution if uploaded files are executable in the site environment.
Researcher notes
Evidence is limited to the CVE description, Wordfence entry, and WordPress Trac references. The provided sources do not name a patched version or provide active exploitation confirmation. Avoid assuming exploit availability beyond the stated arbitrary upload and possible RCE impact.
Mitigation direction
- Identify all WordPress sites using Instant Appointment.
- If running version 1.2 or earlier, disable the plugin until vendor guidance is available.
- Check the WordPress plugin page and vendor advisories for a fixed release.
- Limit file execution in upload directories where supported.
- Use WAF or hosting controls as compensating protection, not as a replacement for remediation.
Validation and detection
- Inventory plugin versions across WordPress environments.
- Confirm whether Instant Appointment version is 1.2 or earlier.
- Review web server and WordPress logs for unusual unauthenticated upload activity.
- Inspect upload directories for unexpected executable or script files.
- Monitor Wordfence, CVE, and WordPress plugin sources for updated remediation details.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-434: File access and web shell behavior lookup
File traversal and upload weaknesses can lead teams to review file, web shell, execution, and collection telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupExecution behavior lookup
The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupFile access behavior lookup
The CVE wording references file access or upload behavior, so file telemetry and web shell review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-15282 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9WordfenceVulnerability scoring details
Base CVSS 3.1 score
9.8CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- Source timelineWordfence
Disclosed
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://www.wordfence.com/threat-intel/vulnerabilities/id/097b1530-64fa-45b2-85f3-c6a2311405b5?source=cveCVE reference, Wordfence
- https://plugins.trac.wordpress.org/browser/instant-appointment/trunk/includes/ajax/ajax_services.php#L3CVE reference, Wordfence
- https://plugins.trac.wordpress.org/browser/instant-appointment/trunk/includes/front-end/ajax/login_ajax.php#L584CVE reference, Wordfence
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Unrestricted Upload of File with Dangerous Type
Unrestricted Upload of File with Dangerous Type represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.