CVE-2026-15282

A WordPress plugin allows unauthenticated attackers to upload arbitrary files, potentially enabling remote code execution.

The Instant Appointment plugin lacks file type validation, permitting unauthenticated attackers to upload files that could lead to remote code execution. While not directly tied to a specific vendor or FedRAMP breach, this vulnerability highlights the risk of third-party software in DIB environments where unpatched plugins can compromise system integrity and data confidentiality.

Shame score — The vulnerability is a known issue in a third-party plugin that could be exploited if not patched, but it does not involve a vendor failure or negligence.