{"metadata": {"vulnerability": "CVE-2026-15282", "count": 24, "kinds": {"milestone": 4, "sighting": 11, "kev": 0, "other": 9}}, "data": [{"timestamp": "2025-03-20T21:44:00Z", "date_only": false, "value": "2025-03-20T21:44:00.000Z", "kind": "other", "label": "Time", "source": "cvelistv5 / Wordfence", "record": "CVE-2026-15282", "field": "containers.cna.timeline.0.time"}, {"timestamp": "2026-07-09T15:48:27.727Z", "date_only": false, "value": "2026-07-09T15:48:27.727Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-15282", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-07-10T04:31:20.078Z", "date_only": false, "value": "2026-07-10T04:31:20.078Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-15282", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-07-10T04:31:20.078Z", "date_only": false, "value": "2026-07-10T04:31:20.078Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / Wordfence", "record": "CVE-2026-15282", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-07-10T05:16:07.130Z", "date_only": false, "value": "2026-07-10T05:16:07.130906Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mqbffamohv2z", "record": "CVE-2026-15282", "field": "creation_timestamp", "uuid": "6a97e3cb-7d82-4d92-934c-386ee349b568", "content": "CVE-2026-15282 - instant appointment\nAn outdated version of the Instant Appointment plugin for WordPress allows unauthorized users to upload any file to the server. This could potentially\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#instantappointment #tenteeglobal #CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3mqbffamohv2z"}, {"timestamp": "2026-07-10T05:16:30Z", "date_only": false, "value": "2026-07-10T05:16:30Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-XP53-G87W-P23F", "record": "GHSA-XP53-G87W-P23F", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-07-10T05:16:30.820Z", "date_only": false, "value": "2026-07-10T05:16:30.820", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-15282", "record": "FKIE_CVE-2026-15282", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-07-10T06:31:20Z", "date_only": false, "value": "2026-07-10T06:31:20Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-XP53-G87W-P23F", "record": "GHSA-XP53-G87W-P23F", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-07-10T06:31:20Z", "date_only": false, "value": "2026-07-10T06:31:20Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-XP53-G87W-P23F", "record": "GHSA-XP53-G87W-P23F", "field": "modified"}, {"timestamp": "2026-07-11T00:00:32.636Z", "date_only": false, "value": "2026-07-11T00:00:32.636759Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/pulse-wp.com/post/3mqde7qogx42j", "record": "CVE-2026-15282", "field": "creation_timestamp", "uuid": "bfffd313-f35a-4061-b0f4-e5874b03e128", "content": "CVE-2026-15282. CVSS 9.8. Instant Appointment plugin lets anyone upload files. wp-config.php. Database dumps. Shell code. All unauth. Update to 1.2 now. Scan: pulse-wp.com\n#WordPress #RCE #CyberSecurity", "url": "https://bsky.app/profile/pulse-wp.com/post/3mqde7qogx42j"}, {"timestamp": "2026-07-13T01:01:18.260Z", "date_only": false, "value": "2026-07-13T01:01:18.260449Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mqiikeondb2b", "record": "CVE-2026-15282", "field": "creation_timestamp", "uuid": "b5fda2d6-ff1d-4b54-a3e4-727102c3180a", "content": "\ud83d\udd34 CVE-2026-15282 - Critical (9.8)\n\nThe Instant Appointment plugin for WordPress is vulnerable to arbitrary file uploads due to missi...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-15282/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "url": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mqiikeondb2b"}, {"timestamp": "2026-07-13T22:00:04.851Z", "date_only": false, "value": "2026-07-13T22:00:04.851312Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/GithubRedTeam/92960", "record": "CVE-2026-15282", "field": "creation_timestamp", "uuid": "57927adf-3556-402e-a0c6-dc119851d727", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #RCE #CVE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-15282\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a shinthink\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-11 10:37:44\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nInstant Appointment <= 1.2 \u2014 Unauthenticated Arbitrary File Upload to RCE via add_service_front AJAX | CVSS 9.8\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/92960"}, {"timestamp": "2026-07-14T00:00:08.045Z", "date_only": false, "value": "2026-07-14T00:00:08.045703Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/92960", "record": "CVE-2026-15282", "field": "creation_timestamp", "uuid": "fb692df5-f467-4793-836d-8eb3cafc0328", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #RCE #CVE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-15282\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a shinthink\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-11 10:37:44\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nInstant Appointment <= 1.2 \u2014 Unauthenticated Arbitrary File Upload to RCE via add_service_front AJAX | CVSS 9.8\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/92960", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-07-14T01:30:46.022Z", "date_only": false, "value": "2026-07-14T01:30:46.022116Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-15282", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-07-14T01:30:46.022Z", "date_only": false, "value": "2026-07-14T01:30:46.022116Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-15282", "record": "FKIE_CVE-2026-15282", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-07-14T01:30:57.647Z", "date_only": false, "value": "2026-07-14T01:30:57.647Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-15282", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-07-14T01:30:57.647Z", "date_only": false, "value": "2026-07-14T01:30:57.647Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-15282", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-07-14T02:16:53.297Z", "date_only": false, "value": "2026-07-14T02:16:53.297", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-15282", "record": "FKIE_CVE-2026-15282", "field": "lastModified"}, {"timestamp": "2026-07-16T19:00:11.955Z", "date_only": false, "value": "2026-07-16T19:00:11.955692Z", "kind": "sighting", "label": "Seen", "source": "Telegram/NYIVWEz-EsB8ef7TazBMjtaMuwPshfSztf-SWjeg1CPetB0", "record": "CVE-2026-15282", "field": "creation_timestamp", "uuid": "ea4933ce-ca86-4075-8707-ece65de14e2a"}, {"timestamp": "2026-07-16T19:00:12.216Z", "date_only": false, "value": "2026-07-16T19:00:12.216559Z", "kind": "sighting", "label": "Seen", "source": "Telegram/Rsr0Dif1o1fLqoV9ucTcV-Dk0Nx-O3i5Fvrar3xcx8-ClWk", "record": "CVE-2026-15282", "field": "creation_timestamp", "uuid": "5ea45208-d90d-44ac-b9fc-d6d84d0bdba9"}, {"timestamp": "2026-07-17T01:00:03.764Z", "date_only": false, "value": "2026-07-17T01:00:03.764600Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/Rsr0Dif1o1fLqoV9ucTcV-Dk0Nx-O3i5Fvrar3xcx8-ClWk", "record": "CVE-2026-15282", "field": "creation_timestamp", "uuid": "13302465-9ce4-474f-8cba-06ac36e281aa", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-07-18T00:00:44.701Z", "date_only": false, "value": "2026-07-18T00:00:44.701784Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/NYIVWEz-EsB8ef7TazBMjtaMuwPshfSztf-SWjeg1CPetB0", "record": "CVE-2026-15282", "field": "creation_timestamp", "uuid": "41982430-1ff4-4343-aa64-3b27b64a5a59", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-10-13T03:00:13Z", "date_only": false, "value": "2026-10-13T03:00:13.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/HbnoNU4lFXE-sEFrlvLF1MJEDHG8hCNidhUZljJJbRhE4_A", "record": "CVE-2026-15282", "field": "creation_timestamp", "uuid": "34bc47da-c902-4037-a018-383a7e70d349", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-10-13T03:00:13Z", "date_only": false, "value": "2026-10-13T03:00:13.000000Z", "kind": "sighting", "label": "Seen", "source": "Telegram/HbnoNU4lFXE-sEFrlvLF1MJEDHG8hCNidhUZljJJbRhE4_A", "record": "CVE-2026-15282", "field": "creation_timestamp", "uuid": "52ff2f9e-e96e-4bac-befe-3c8e1c7f81ce"}], "metrics": {"as_of": "2026-11-02T02:57:53.603Z", "anchors": {"origin": {"timestamp": "2026-07-10T04:31:20.078Z", "date_only": false, "value": "2026-07-10T04:31:20.078Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-15282", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-07-10T04:31:20.078Z", "date_only": false, "value": "2026-07-10T04:31:20.078Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-15282", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": {"timestamp": "2026-07-14T00:00:08.045Z", "date_only": false, "value": "2026-07-14T00:00:08.045703Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/92960", "record": "CVE-2026-15282", "field": "creation_timestamp", "uuid": "fb692df5-f467-4793-836d-8eb3cafc0328", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #RCE #CVE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-15282\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a shinthink\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-11 10:37:44\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nInstant Appointment <= 1.2 \u2014 Unauthenticated Arbitrary File Upload to RCE via add_service_front AJAX | CVSS 9.8\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/92960", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": true, "seconds": 329327.967, "hours": 91.47999083333333, "days": 3.8116662847222225, "min_seconds": 329327.967, "max_seconds": 329327.967, "approximate": false, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-07-10T04:31:20.078Z", "date_only": false, "value": "2026-07-10T04:31:20.078Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-15282", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-07-14T00:00:08.045Z", "date_only": false, "value": "2026-07-14T00:00:08.045703Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/92960", "record": "CVE-2026-15282", "field": "creation_timestamp", "uuid": "fb692df5-f467-4793-836d-8eb3cafc0328", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #RCE #CVE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-15282\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a shinthink\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-11 10:37:44\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nInstant Appointment <= 1.2 \u2014 Unauthenticated Arbitrary File Upload to RCE via add_service_front AJAX | CVSS 9.8\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/92960", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 9930393.525458, "hours": 2758.4426459605556, "days": 114.9351102483565, "min_seconds": 9930393.525458, "max_seconds": 9930393.525458, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-07-10T04:31:20.078Z", "date_only": false, "value": "2026-07-10T04:31:20.078Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-15282", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-02T02:57:53.603Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": true, "seconds": 9601065.558458, "hours": 2666.962655127222, "days": 111.12344396363426, "min_seconds": 9601065.558458, "max_seconds": 9601065.558458, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-07-14T00:00:08.045Z", "date_only": false, "value": "2026-07-14T00:00:08.045703Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/92960", "record": "CVE-2026-15282", "field": "creation_timestamp", "uuid": "fb692df5-f467-4793-836d-8eb3cafc0328", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #RCE #CVE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-15282\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a shinthink\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-11 10:37:44\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nInstant Appointment <= 1.2 \u2014 Unauthenticated Arbitrary File Upload to RCE via add_service_front AJAX | CVSS 9.8\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/92960", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "end": {"timestamp": "2026-11-02T02:57:53.603Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}}}