{"metadata": {"vulnerability": "CVE-2026-103366", "count": 15, "kinds": {"milestone": 4, "sighting": 1, "kev": 0, "other": 10}}, "data": [{"timestamp": "2026-09-30T12:59:59.590Z", "date_only": false, "value": "2026-09-30T12:59:59.590Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-103366", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-09-30T13:16:23Z", "date_only": false, "value": "2026-09-30T13:16:23.000Z", "kind": "other", "label": "Time", "source": "cvelistv5 / Wordfence", "record": "CVE-2026-103366", "field": "containers.cna.timeline.0.time"}, {"timestamp": "2026-10-13T19:19:27Z", "date_only": false, "value": "2026-10-13T19:19:27.000Z", "kind": "other", "label": "Time", "source": "cvelistv5 / Wordfence", "record": "CVE-2026-103366", "field": "containers.cna.timeline.1.time"}, {"timestamp": "2026-10-14T07:43:31.890Z", "date_only": false, "value": "2026-10-14T07:43:31.890Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-103366", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-14T07:43:31.890Z", "date_only": false, "value": "2026-10-14T07:43:31.890Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / Wordfence", "record": "CVE-2026-103366", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-14T08:17:02Z", "date_only": false, "value": "2026-10-14T08:17:02Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-3PF7-5297-2FFV", "record": "GHSA-3PF7-5297-2FFV", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-14T08:17:02.417Z", "date_only": false, "value": "2026-10-14T08:17:02.417", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-103366", "record": "FKIE_CVE-2026-103366", "field": "published"}, {"timestamp": "2026-10-14T09:31:33Z", "date_only": false, "value": "2026-10-14T09:31:33Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-3PF7-5297-2FFV", "record": "GHSA-3PF7-5297-2FFV", "field": "published"}, {"timestamp": "2026-10-14T09:31:33Z", "date_only": false, "value": "2026-10-14T09:31:33Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-3PF7-5297-2FFV", "record": "GHSA-3PF7-5297-2FFV", "field": "modified"}, {"timestamp": "2026-10-14T17:32:13.403Z", "date_only": false, "value": "2026-10-14T17:32:13.403427Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117440455163327940", "record": "CVE-2026-103366", "field": "creation_timestamp", "uuid": "91b890c4-f59d-4fe1-8339-1d1fbc5efa73", "content": "CVE-2026-103366 Appointment Booking Plugin <= 5.7.3 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'booking[id]' and 'cart[id]' Parameters The Appointment Booking Plugin \u2013 LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 5.7.3 via the `booking[id]` and `cart[id]` parameters on the `steps__reload_booking_form_summary_panel` and `steps__start` public routes (reachable through wp_ajax_nopriv_latepoint_route_call). This is due to `OsStepsHelper::set_required_objects()` feeding raw request parameters into `set_booking_object()` and `set_cart_object()`, which call `OsModel::set_data()` and load an arbitrary booking or cart row by primary key with no ownership check \u2014 the ownership guard the vendor added for the earlier disclosure lives only inside `OsStepsHelper::load_step()` and does not cover the sibling routes or `cart[id]` at all. This makes it possible for unauthenticated attackers to enumerate sequential booking / cart identifiers and read other customers' appointment details (service name, agent, date/time, duration, price breakdown, status) and other shoppers' pending checkout contents directly from the JSON responses.\nhttps://www.cve.org/CVERecord?id=CVE-2026-103366https://www.wordfence.com/threat-intel/vulnerabilities/id/2f13d1ac-d1b4-4802-bee2-3622e84d7482?source=cvehttps://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.3/lib/helpers/steps_helper.php#L1232https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.3/lib/helpers/steps_helper.php#L3228https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.3/lib/models/model.php#L580https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.3/lib/controllers/steps_controller.php#L145https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.3/lib/controllers/steps_controller.php#L290https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.3/lib/helpers/steps_helper.php#L234https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.3/latepoint.php#L1072https://plugins.trac.wordpress.org/changeset?reponame=&old=3728691%40latepoint&new=3728691%40latepoint#wordpress #latepoint #AppointmentBookingPlugin\u2013LatePoint|Calendar&SchedulingforWordPress#CVE_2026_103366#bot", "url": "https://infosec.exchange/users/cve/statuses/117440455163327940"}, {"timestamp": "2026-10-15T10:47:08.354Z", "date_only": false, "value": "2026-10-15T10:47:08.354377Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-103366", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-10-15T10:47:08.354Z", "date_only": false, "value": "2026-10-15T10:47:08.354377Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-103366", "record": "FKIE_CVE-2026-103366", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-10-15T16:43:49.470Z", "date_only": false, "value": "2026-10-15T16:43:49.470Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-103366", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-15T16:43:49.470Z", "date_only": false, "value": "2026-10-15T16:43:49.470Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-103366", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-15T17:17:10.770Z", "date_only": false, "value": "2026-10-15T17:17:10.770", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-103366", "record": "FKIE_CVE-2026-103366", "field": "lastModified"}]}