CVE-2026-15282

Name of the Vulnerable Software and Affected Versions Instant Appointment versions prior to 1.3

Description The Instant Appointment plugin for WordPress allows unauthenticated attackers to upload arbitrary files to the server. This issue occurs because the insapp upload image as attachment() function fails to validate file types, which could lead to remote code execution.

Recommendations Update the plugin to version 1.3 or later. As a temporary workaround, restrict access to the insapp upload image as attachment() function to minimize the risk of exploitation.