A critical arbitrary file upload vulnerability in the Instant Appointment WordPress plugin allows unauthenticated attackers to achieve remote code execution on affected servers.

This vulnerability stems from missing file type validation in the insapp_upload_image_as_attachment function. Because the function lacks authentication requirements, any unauthenticated attacker can upload malicious files, such as web shells, to the server.

The ability for an unauthenticated attacker to upload arbitrary files poses a catastrophic risk to business operations. Successful exploitation results in full Remote Code Execution (RCE), allowing the attacker to compromise the entire server, exfiltrate sensitive data, or deploy ransomware. With a CVSS score of 9.8, this vulnerability represents an immediate threat to the confidentiality, integrity, and availability of the host environment.

Immediate Action: Update the Instant Appointment plugin to the latest available version immediately to patch the missing validation logic.

Proactive Monitoring: Monitor server access logs for suspicious POST requests targeting the insapp_upload_image_as_attachment function or unexpected file creations in the WordPress upload directories.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block file uploads containing executable extensions (e.g., .php, .phtml) until the plugin can be updated.

Public Exploit Available: No

Given the ease of exploitability and the critical impact, administrators must prioritize patching this plugin. If an immediate update is not feasible, the plugin should be disabled or removed from the environment until such time that the vulnerability is remediated.