EUVD-2026-42790
GHSA-xp53-g87w-p23f
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated network-reachable upload endpoint (AV:N/AC:L/PR:N/UI:N) yielding webshell RCE gives full C/I/A impact; scope unchanged as code runs within the web server context.
Primary rating from Vendor (wordfence).
CVSS VectorVendor: wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Instant Appointment plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'insapp_upload_image_as_attachment' function in all versions up to, and including, 1.2. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
Articles & Coverage 1
AnalysisAI
Unauthenticated arbitrary file upload in the Instant Appointment WordPress plugin (all versions ≤ 1.2) lets remote attackers upload files of any type through the 'insapp_upload_image_as_attachment' function, which lacks file-type validation, potentially enabling remote code execution by planting a PHP webshell. Any WordPress site running the plugin is exploitable without authentication or user interaction, matching its 9.8 CVSS rating. No public exploit identified at time of analysis, and the flaw is not in CISA KEV.
Technical ContextAI
This is a CWE-434 (Unrestricted Upload of File with Dangerous Type) weakness in a WordPress plugin's AJAX-driven attachment handler. The vulnerable code path is the 'insapp_upload_image_as_attachment' function referenced in the plugin's front-end AJAX handlers (login_ajax.php and ajax_services.php per the WordPress plugin trac source). The function is intended to accept image uploads for appointment attachments but fails to enforce an allow-list of extensions or MIME types, so any file - including a .php script - is written into the site's uploads directory. Because WordPress serves the uploads directory over HTTP and PHP files placed there are typically executed by the web server, an uploaded PHP file can be requested directly to achieve code execution in the web server's context.
RemediationAI
No vendor-released patch identified at time of analysis - the input shows all versions through 1.2 as vulnerable with no fixed release. Monitor the plugin's WordPress.org page and the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/097b1530-64fa-45b2-85f3-c6a2311405b5) for an update beyond 1.2 and apply it immediately once published. Until a fix exists, the strongest compensating control is to deactivate and remove the Instant Appointment plugin, which eliminates the vulnerable endpoint at the cost of losing appointment-booking functionality. If the plugin must remain active, use a WAF (such as Wordfence) to block requests to the plugin's upload AJAX actions, and harden the server by disabling PHP execution within the wp-content/uploads directory (e.g. an .htaccess/nginx rule denying execution of .php files there), which blocks the RCE step even if an upload succeeds; the trade-off is that legitimate features relying on server-side processing of uploads in that path may break. Restrict access to /wp-admin/admin-ajax.php from untrusted networks where feasible.
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
Share
External POC / Exploit Code
Leaving vuln.today