CVE-2026-15282: WordPress Instant Appointment RCE Flaw

CVE-2026-15282 Overview

CVE-2026-15282 is an arbitrary file upload vulnerability in the Instant Appointment plugin for WordPress. The flaw resides in the insapp_upload_image_as_attachment function, which fails to validate file types before writing uploaded content to disk. All plugin versions up to and including 1.2 are affected. Unauthenticated attackers can upload arbitrary files to the server, including PHP scripts, which enables remote code execution on the WordPress host. The weakness is classified as [CWE-434] Unrestricted Upload of File with Dangerous Type.

Critical Impact
Unauthenticated remote attackers can upload executable files and achieve remote code execution on any WordPress site running Instant Appointment <= 1.2.

Affected Products

Instant Appointment plugin for WordPress, versions up to and including 1.2
WordPress sites exposing the plugin's AJAX endpoints publicly
Any hosting environment allowing PHP execution in the WordPress uploads directory

Discovery Timeline

2026-07-10 - CVE-2026-15282 published to NVD
2026-07-14 - Last updated in NVD database

Technical Details for CVE-2026-15282

Vulnerability Analysis

The Instant Appointment plugin exposes an AJAX handler that invokes insapp_upload_image_as_attachment to process client-submitted files. The function accepts uploads without inspecting the MIME type, file extension, or magic bytes of the incoming data. Because the handler is reachable through unauthenticated AJAX actions, any remote user can invoke it. An attacker can submit a PHP file disguised as an image upload and have it written into the WordPress uploads directory. Requesting the file's URL then executes attacker-controlled code under the web server user, giving full application-level compromise.

Root Cause

The root cause is missing file type validation in insapp_upload_image_as_attachment. The function does not enforce an allowlist of MIME types, does not reject dangerous extensions such as .php or .phtml, and does not verify the uploaded content matches an image format. Reference implementations are visible in includes/ajax/ajax_services.php and includes/front-end/ajax/login_ajax.php within the plugin source tree.

Attack Vector

The attack is fully remote and unauthenticated. An attacker sends a crafted multipart/form-data POST request to the plugin's AJAX endpoint carrying a malicious file. Once the file is stored, the attacker retrieves it from its predictable location under /wp-content/uploads/ to trigger execution. See the Wordfence advisory and the vulnerable functions at login_ajax.php line 584 and line 598 for technical details.

Detection Methods for CVE-2026-15282

Indicators of Compromise

Files with executable extensions such as .php, .phtml, or .phar present under /wp-content/uploads/ after plugin activity
POST requests to admin-ajax.php referencing Instant Appointment actions from unauthenticated sources
New administrator accounts, modified plugin files, or webshell artifacts appearing after upload requests
Outbound connections from the web server process to unfamiliar hosts following an upload event

Detection Strategies

Inspect web server logs for POST requests to admin-ajax.php invoking Instant Appointment actions with multipart/form-data payloads
Hash and diff files in wp-content/uploads/ against a known-good baseline to surface new script files
Deploy a Web Application Firewall rule blocking uploads whose content type or magic bytes do not match an image

Monitoring Recommendations

Alert on any process spawned by the PHP-FPM or web server user that executes shell binaries such as sh, bash, or python
Monitor file integrity of the WordPress document root and uploads directory for new PHP files
Track outbound network connections initiated by the web server to identify command-and-control traffic

How to Mitigate CVE-2026-15282

Immediate Actions Required

Deactivate and remove the Instant Appointment plugin until a patched release is confirmed
Audit wp-content/uploads/ for unexpected PHP or script files and remove any attacker-planted content
Rotate WordPress administrator passwords, database credentials, and any secrets stored in wp-config.php
Review installed plugins, themes, and user accounts for unauthorized modifications

Patch Information

No fixed version is listed in the NVD entry at publication. Site owners should monitor the Wordfence threat intelligence entry and the plugin's WordPress.org page for an updated release. Until a vendor patch is available, the plugin should not be run on production sites.

Workarounds

Block execution of PHP files inside wp-content/uploads/ using web server configuration
Restrict access to the plugin's AJAX endpoints at the WAF or reverse proxy layer
Enforce authentication in front of admin-ajax.php where feasible for the deployment model

bash

# Deny PHP execution in the WordPress uploads directory (Apache .htaccess)
<FilesMatch "\.(php|phtml|phar|php7|phps)$">
    Require all denied
</FilesMatch>

# Equivalent Nginx configuration
location ~* /wp-content/uploads/.*\.(php|phtml|phar)$ {
    deny all;
    return 403;
}