Instant Appointment WordPress Plugin Unauthenticated Arbitrary File Upload Vulnerability

A vulnerability allowing unauthenticated arbitrary file uploads has been identified in the Instant Appointment WordPress plugin, affecting all versions through 1.2. The issue arises from inadequate file type validation in the 'insapp_upload_image_as_attachment' function. This flaw enables attackers to upload arbitrary files to the server, potentially leading to remote code execution.

Impact

Exploitation of this vulnerability could result in unauthorized file uploads, with the potential for remote code execution on the affected server.

Reproduction

The vulnerability can be reproduced by sending a request to the 'wp_ajax_add_service_front' or 'wp_ajax_update_service_front' AJAX actions. The request must include the 'image_url' parameter with a URL pointing to the file to be uploaded, along with the 'image_name' parameter specifying the filename. The absence of proper file type validation allows for the upload of potentially malicious files.

Remediation

No known patch is available. It is recommended to uninstall the affected plugin and consider a replacement.