The tenteeglobal:Instant Appointment plugin for WordPress contains a flaw in the 'insapp_upload_image_as_attachment' function, allowing any file type to be uploaded without validation. An unauthenticated attacker can place executable or malicious files on the web server, creating the possibility of remote code execution. The CVSS score of 9.8 marks this as a critical vulnerability, while the absence of proper file type checks underpins its severity.

All WordPress installations that have the tenteeglobal:Instant Appointment plugin enabled and are running version 1.2 or earlier are affected. Any site that exposes the plugin’s upload functionality is vulnerable, regardless of user authentication state.

The likely attack vector is inferred to be the plugin’s Ajax upload endpoint, as the description indicates that unauthenticated attackers can upload arbitrary files. By crafting a request to this endpoint the attacker can place malicious or executable files on the server, potentially enabling remote code execution. The EPSS score of 1% suggests that real‑world exploitation is currently low, yet the CVSS score of 9.8, combined with the lack of intrinsic mitigations, indicates a high severity level. Although the vulnerability is not listed in CISA’s KEV catalog, its critical nature warrants prompt attention.