Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
96 vulnerabilities by latepoint
CVE-2026-111602 (GCVE-0-2026-111602)
Vulnerability from nvd – Published: 2026-10-17 02:31 – Updated: 2026-10-18 11:22
VLAI
EPSS
VEX
Title
Appointment Booking Plugin <= 5.7.4 - Unauthenticated Sensitive Information Disclosure via ORM Operator Injection in 'customer[uuid]' Parameter
Summary
The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.7.4 via the 'params (customer[uuid])' parameter. This makes it possible for unauthenticated attackers to extract the first name, last name, email address, phone number, and notes of every customer record in the database by enumerating uuid prefixes via the unauthenticated steps__load_step AJAX endpoint. This vulnerability is only exploitable when the LatePoint plugin is configured with the 'Field used for authentication' setting set to 'Disable ability to login' (guest checkout mode).
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-18 11:09 UTC
CWE
- CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
Assigner
References
6 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| latepoint | Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress |
Affected:
0 , ≤ 5.7.4
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-111602",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-18T11:09:30.558764Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-18T11:22:47.696Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Appointment Booking Plugin \u2013 LatePoint | Calendar \u0026 Scheduling for WordPress",
"vendor": "latepoint",
"versions": [
{
"lessThanOrEqual": "5.7.4",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Ji\u0159\u00ed Fryjauf (jfryjauf)"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Appointment Booking Plugin \u2013 LatePoint | Calendar \u0026 Scheduling for WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.7.4 via the \u0027params (customer[uuid])\u0027 parameter. This makes it possible for unauthenticated attackers to extract the first name, last name, email address, phone number, and notes of every customer record in the database by enumerating uuid prefixes via the unauthenticated steps__load_step AJAX endpoint. This vulnerability is only exploitable when the LatePoint plugin is configured with the \u0027Field used for authentication\u0027 setting set to \u0027Disable ability to login\u0027 (guest checkout mode)."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 3.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-17T02:31:07.048Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6afce24f-30cd-4aeb-a5dd-20bd80a75779?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.4/lib/helpers/steps_helper.php#L1175"
},
{
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.4/lib/controllers/steps_controller.php#L355"
},
{
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.4/lib/models/model.php#L379"
},
{
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.4/lib/helpers/params_helper.php#L14"
},
{
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.5/lib/controllers/steps_controller.php"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-08T22:13:58.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-10-16T14:30:46.000Z",
"value": "Disclosed"
}
],
"title": "Appointment Booking Plugin \u003c= 5.7.4 - Unauthenticated Sensitive Information Disclosure via ORM Operator Injection in \u0027customer[uuid]\u0027 Parameter"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-111602",
"datePublished": "2026-10-17T02:31:07.048Z",
"dateReserved": "2026-10-16T14:30:12.558Z",
"dateUpdated": "2026-10-18T11:22:47.696Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-110653 (GCVE-0-2026-110653)
Vulnerability from nvd – Published: 2026-10-17 02:31 – Updated: 2026-10-18 11:22
VLAI
EPSS
VEX
Title
Appointment Booking Plugin <= 5.7.4 - Unauthenticated Authentication Bypass via Race Condition on OTP Attempts Counter
Summary
The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Authentication Bypass via Race Condition in all versions up to, and including, 5.7.4. This is due to a non-atomic read-modify-write on the OTP verification attempts counter in the `verifyOTP` function: the counter is incremented using a stale in-memory value with no conditional `WHERE attempts < 10` guard on the `UPDATE` and no `SELECT ... FOR UPDATE` row lock, creating a TOCTOU window that allows concurrent requests to bypass the 10-attempt lockout. This makes it possible for unauthenticated attackers — who know a target customer's registered email address or phone number — to fire concurrent requests to the `auth__verify_otp` endpoint, defeat the lockout cap, brute-force the 6-digit OTP code, and authenticate as the targeted LatePoint customer, gaining full access to their account, bookings, and personal data. The nonce check present on the endpoint (`otp_verify_otp_nonce`) does not mitigate this issue, as the nonce is publicly emitted by the unauthenticated `request_otp` and `resend_otp` endpoints and is trivially obtainable by any unauthenticated attacker prior to launching the race.
Severity
9.1 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-18 11:09 UTC
CWE
- CWE-287 - Improper Authentication
Assigner
References
7 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| latepoint | Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress |
Affected:
0 , ≤ 5.7.4
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-110653",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-18T11:09:42.337028Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-18T11:22:47.841Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Appointment Booking Plugin \u2013 LatePoint | Calendar \u0026 Scheduling for WordPress",
"vendor": "latepoint",
"versions": [
{
"lessThanOrEqual": "5.7.4",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Ekene Umegakwe"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Appointment Booking Plugin \u2013 LatePoint | Calendar \u0026 Scheduling for WordPress plugin for WordPress is vulnerable to Authentication Bypass via Race Condition in all versions up to, and including, 5.7.4. This is due to a non-atomic read-modify-write on the OTP verification attempts counter in the `verifyOTP` function: the counter is incremented using a stale in-memory value with no conditional `WHERE attempts \u003c 10` guard on the `UPDATE` and no `SELECT ... FOR UPDATE` row lock, creating a TOCTOU window that allows concurrent requests to bypass the 10-attempt lockout. This makes it possible for unauthenticated attackers \u2014 who know a target customer\u0027s registered email address or phone number \u2014 to fire concurrent requests to the `auth__verify_otp` endpoint, defeat the lockout cap, brute-force the 6-digit OTP code, and authenticate as the targeted LatePoint customer, gaining full access to their account, bookings, and personal data. The nonce check present on the endpoint (`otp_verify_otp_nonce`) does not mitigate this issue, as the nonce is publicly emitted by the unauthenticated `request_otp` and `resend_otp` endpoints and is trivially obtainable by any unauthenticated attacker prior to launching the race."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "CWE-287 Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-17T02:31:06.697Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/61fbc1dd-06c9-409b-8cad-3f350b38dfc3?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.4/lib/helpers/otp_helper.php#L228"
},
{
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.4/lib/helpers/otp_helper.php#L185"
},
{
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.4/lib/controllers/auth_controller.php#L30"
},
{
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.4/lib/controllers/auth_controller.php#L14"
},
{
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.4/lib/models/model.php#L773"
},
{
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.5/lib/helpers/otp_helper.php"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-14T13:23:22.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-10-16T14:24:52.000Z",
"value": "Disclosed"
}
],
"title": "Appointment Booking Plugin \u003c= 5.7.4 - Unauthenticated Authentication Bypass via Race Condition on OTP Attempts Counter"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-110653",
"datePublished": "2026-10-17T02:31:06.697Z",
"dateReserved": "2026-10-14T13:08:07.307Z",
"dateUpdated": "2026-10-18T11:22:47.841Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-103380 (GCVE-0-2026-103380)
Vulnerability from nvd – Published: 2026-10-14 07:43 – Updated: 2026-10-15 16:43
VLAI
EPSS
VEX
Title
Appointment Booking Plugin <= 5.7.3 - Authenticated (Subscriber+) Sensitive Information Exposure in 'first_name' Parameter Template Re-expansion
Summary
The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.7.3 via the 'params[customer][first_name]' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract privileged booking data including the administrator-only admin_notes field, assigned agent internal contact details, transaction tokens, and payment request URLs delivered via rendered notification emails. A LatePoint customer can exploit this by storing a template placeholder such as {{customer_admin_notes}} in their own first_name field via the customer_cabinet__update route, then triggering the password-reset email flow to receive the expanded value in the resulting notification.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-15 10:52 UTC
CWE
- CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
Assigner
References
7 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| latepoint | Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress |
Affected:
0 , ≤ 5.7.3
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-103380",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-15T10:52:24.378589Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T16:43:49.346Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Appointment Booking Plugin \u2013 LatePoint | Calendar \u0026 Scheduling for WordPress",
"vendor": "latepoint",
"versions": [
{
"lessThanOrEqual": "5.7.3",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "walid213"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Appointment Booking Plugin \u2013 LatePoint | Calendar \u0026 Scheduling for WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.7.3 via the \u0027params[customer][first_name]\u0027 parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract privileged booking data including the administrator-only admin_notes field, assigned agent internal contact details, transaction tokens, and payment request URLs delivered via rendered notification emails. A LatePoint customer can exploit this by storing a template placeholder such as {{customer_admin_notes}} in their own first_name field via the customer_cabinet__update route, then triggering the password-reset email flow to receive the expanded value in the resulting notification."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T07:43:32.242Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4494960c-66ed-47d9-b3fc-5a5ec5a07b1f?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.3/lib/helpers/replacer_helper.php#L278"
},
{
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.3/lib/helpers/replacer_helper.php#L614"
},
{
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.3/lib/controllers/customer_cabinet_controller.php#L321"
},
{
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.3/lib/models/customer_model.php#L388"
},
{
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.3/lib/mailers/customer_mailer.php#L33"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3728691%40latepoint\u0026new=3728691%40latepoint"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-30T13:29:47.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-10-13T19:18:51.000Z",
"value": "Disclosed"
}
],
"title": "Appointment Booking Plugin \u003c= 5.7.3 - Authenticated (Subscriber+) Sensitive Information Exposure in \u0027first_name\u0027 Parameter Template Re-expansion"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-103380",
"datePublished": "2026-10-14T07:43:32.242Z",
"dateReserved": "2026-09-30T13:14:36.283Z",
"dateUpdated": "2026-10-15T16:43:49.346Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-103366 (GCVE-0-2026-103366)
Vulnerability from nvd – Published: 2026-10-14 07:43 – Updated: 2026-10-15 16:43
VLAI
EPSS
VEX
Title
Appointment Booking Plugin <= 5.7.3 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'booking[id]' and 'cart[id]' Parameters
Summary
The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 5.7.3 via the `booking[id]` and `cart[id]` parameters on the `steps__reload_booking_form_summary_panel` and `steps__start` public routes (reachable through wp_ajax_nopriv_latepoint_route_call). This is due to `OsStepsHelper::set_required_objects()` feeding raw request parameters into `set_booking_object()` and `set_cart_object()`, which call `OsModel::set_data()` and load an arbitrary booking or cart row by primary key with no ownership check — the ownership guard the vendor added for the earlier disclosure lives only inside `OsStepsHelper::load_step()` and does not cover the sibling routes or `cart[id]` at all. This makes it possible for unauthenticated attackers to enumerate sequential booking / cart identifiers and read other customers' appointment details (service name, agent, date/time, duration, price breakdown, status) and other shoppers' pending checkout contents directly from the JSON responses.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-15 10:47 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
9 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| latepoint | Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress |
Affected:
0 , ≤ 5.7.3
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-103366",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-15T10:47:08.354377Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T16:43:49.470Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Appointment Booking Plugin \u2013 LatePoint | Calendar \u0026 Scheduling for WordPress",
"vendor": "latepoint",
"versions": [
{
"lessThanOrEqual": "5.7.3",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "churchill11"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Appointment Booking Plugin \u2013 LatePoint | Calendar \u0026 Scheduling for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 5.7.3 via the `booking[id]` and `cart[id]` parameters on the `steps__reload_booking_form_summary_panel` and `steps__start` public routes (reachable through wp_ajax_nopriv_latepoint_route_call). This is due to `OsStepsHelper::set_required_objects()` feeding raw request parameters into `set_booking_object()` and `set_cart_object()`, which call `OsModel::set_data()` and load an arbitrary booking or cart row by primary key with no ownership check \u2014 the ownership guard the vendor added for the earlier disclosure lives only inside `OsStepsHelper::load_step()` and does not cover the sibling routes or `cart[id]` at all. This makes it possible for unauthenticated attackers to enumerate sequential booking / cart identifiers and read other customers\u0027 appointment details (service name, agent, date/time, duration, price breakdown, status) and other shoppers\u0027 pending checkout contents directly from the JSON responses."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639 Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T07:43:31.890Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2f13d1ac-d1b4-4802-bee2-3622e84d7482?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.3/lib/helpers/steps_helper.php#L1232"
},
{
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.3/lib/helpers/steps_helper.php#L3228"
},
{
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.3/lib/models/model.php#L580"
},
{
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.3/lib/controllers/steps_controller.php#L145"
},
{
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.3/lib/controllers/steps_controller.php#L290"
},
{
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.3/lib/helpers/steps_helper.php#L234"
},
{
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.3/latepoint.php#L1072"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3728691%40latepoint\u0026new=3728691%40latepoint"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-30T13:16:23.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-10-13T19:19:27.000Z",
"value": "Disclosed"
}
],
"title": "Appointment Booking Plugin \u003c= 5.7.3 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via \u0027booking[id]\u0027 and \u0027cart[id]\u0027 Parameters"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-103366",
"datePublished": "2026-10-14T07:43:31.890Z",
"dateReserved": "2026-09-30T12:59:59.590Z",
"dateUpdated": "2026-10-15T16:43:49.470Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-100163 (GCVE-0-2026-100163)
Vulnerability from nvd – Published: 2026-10-14 07:43 – Updated: 2026-10-14 17:41
VLAI
EPSS
VEX
Title
Appointment Booking Plugin <= 5.7.2 - Unauthenticated Authentication Bypass to Customer Account Takeover via Insufficient Verification in create_wp_user_for_customer() username_exists Fallback
Summary
The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 5.7.2 via the OsCustomerHelper::create_wp_user_for_customer() helper reached from the public process_step_customer() booking step. When the 'Use WordPress users as customers' option is enabled, the helper falls back from email_exists() to username_exists( $customer->email ), which matches any WordPress user whose user_login equals the victim customer's email even when that user's user_email is completely different, and links that WordPress user's ID into the victim's LatePoint customer row (only privileged roles are excluded; Subscriber is allowed). This makes it possible for authenticated attackers, with Subscriber-level access and above, to take over another customer's LatePoint account — accessing their bookings, service, agent, and calendar data, and having the victim customer's email overwritten with the attacker's on next login — by holding a Subscriber account whose user_login equals the victim's email and submitting an unauthenticated public booking step registration request.
Severity
7.4 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-14 17:40 UTC
CWE
- CWE-287 - Improper Authentication
Assigner
References
7 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| latepoint | Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress |
Affected:
0 , ≤ 5.7.2
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-100163",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-14T17:40:58.748355Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T17:41:31.054Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Appointment Booking Plugin \u2013 LatePoint | Calendar \u0026 Scheduling for WordPress",
"vendor": "latepoint",
"versions": [
{
"lessThanOrEqual": "5.7.2",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "OKISO"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Appointment Booking Plugin \u2013 LatePoint | Calendar \u0026 Scheduling for WordPress plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 5.7.2 via the OsCustomerHelper::create_wp_user_for_customer() helper reached from the public process_step_customer() booking step. When the \u0027Use WordPress users as customers\u0027 option is enabled, the helper falls back from email_exists() to username_exists( $customer-\u003eemail ), which matches any WordPress user whose user_login equals the victim customer\u0027s email even when that user\u0027s user_email is completely different, and links that WordPress user\u0027s ID into the victim\u0027s LatePoint customer row (only privileged roles are excluded; Subscriber is allowed). This makes it possible for authenticated attackers, with Subscriber-level access and above, to take over another customer\u0027s LatePoint account \u2014 accessing their bookings, service, agent, and calendar data, and having the victim customer\u0027s email overwritten with the attacker\u0027s on next login \u2014 by holding a Subscriber account whose user_login equals the victim\u0027s email and submitting an unauthenticated public booking step registration request."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "CWE-287 Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T07:43:31.547Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2a942d71-7172-4e02-9faa-3a2c1c9e7fbd?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.2/lib/helpers/customer_helper.php#L259"
},
{
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.2/lib/helpers/customer_helper.php#L274"
},
{
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.2/lib/helpers/steps_helper.php#L2156"
},
{
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.2/lib/helpers/steps_helper.php#L2146"
},
{
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.2/latepoint.php#L1072"
},
{
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.3/lib/helpers/customer_helper.php"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-25T12:49:14.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-10-13T19:19:40.000Z",
"value": "Disclosed"
}
],
"title": "Appointment Booking Plugin \u003c= 5.7.2 - Unauthenticated Authentication Bypass to Customer Account Takeover via Insufficient Verification in create_wp_user_for_customer() username_exists Fallback"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-100163",
"datePublished": "2026-10-14T07:43:31.547Z",
"dateReserved": "2026-09-25T12:34:07.288Z",
"dateUpdated": "2026-10-14T17:41:31.054Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-96662 (GCVE-0-2026-96662)
Vulnerability from nvd – Published: 2026-10-10 07:41 – Updated: 2026-10-11 16:55
VLAI
EPSS
VEX
Title
Appointment Booking Plugin <= 5.7.2 - Unauthenticated SQL Injection via 'booking[service_id]' Parameter
Summary
The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to generic SQL Injection via 'booking[service_id]' Parameter in all versions up to, and including, 5.7.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-11 16:39 UTC
CWE
- CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Assigner
References
9 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| latepoint | Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress |
Affected:
0 , ≤ 5.7.2
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-96662",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-11T16:39:57.704939Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-11T16:55:15.993Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Appointment Booking Plugin \u2013 LatePoint | Calendar \u0026 Scheduling for WordPress",
"vendor": "latepoint",
"versions": [
{
"lessThanOrEqual": "5.7.2",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "zickzick2"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Appointment Booking Plugin \u2013 LatePoint | Calendar \u0026 Scheduling for WordPress plugin for WordPress is vulnerable to generic SQL Injection via \u0027booking[service_id]\u0027 Parameter in all versions up to, and including, 5.7.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-10T07:41:43.527Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/18c1a5a0-dee0-45ee-9e8b-0937b392eccd?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.1/lib/models/model.php#L403"
},
{
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.1/lib/helpers/connector_helper.php#L212"
},
{
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.1/lib/helpers/steps_helper.php#L1825"
},
{
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.1/lib/helpers/steps_helper.php#L1231"
},
{
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.1/lib/controllers/steps_controller.php#L356"
},
{
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.1/lib/controllers/steps_controller.php#L22"
},
{
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.1/latepoint.php#L1072"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3718438%40latepoint\u0026new=3718438%40latepoint"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-23T15:06:47.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-10-09T19:23:35.000Z",
"value": "Disclosed"
}
],
"title": "Appointment Booking Plugin \u003c= 5.7.2 - Unauthenticated SQL Injection via \u0027booking[service_id]\u0027 Parameter"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-96662",
"datePublished": "2026-10-10T07:41:43.527Z",
"dateReserved": "2026-09-23T14:51:55.113Z",
"dateUpdated": "2026-10-11T16:55:15.993Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-91050 (GCVE-0-2026-91050)
Vulnerability from nvd – Published: 2026-10-10 05:30 – Updated: 2026-10-11 16:55
VLAI
EPSS
VEX
Title
Appointment Booking Plugin <= 5.7.2 - Insecure Direct Object Reference to Authenticated (Subscriber+) Unauthorized Booking Creation and Sensitive Information Disclosure via 'params[presets][order_item_id]' Parameter
Summary
The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference / Missing Authorization in versions up to, and including, 5.7.2. This is due to the publicly reachable steps__start and steps__load_step routes accepting a params[presets][order_item_id] value that is copied verbatim into the booking object without verifying that the referenced order item belongs to the current customer, is a bundle item, is paid, or has remaining capacity — the is_bundle_scheduling() bundle discriminator is a mere !empty(order_item_id) truthiness check, and the code flow explicitly removes the customer and payment steps when this is truthy (the source even carries a TODO acknowledging the missing validation). This makes it possible for unauthenticated attackers to create approved appointments against other customers' order items and to read those customers' names, email addresses, and order codes returned in the booking confirmation.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-11 16:41 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
8 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| latepoint | Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress |
Affected:
0 , ≤ 5.7.2
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-91050",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-11T16:41:31.200374Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-11T16:55:18.699Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Appointment Booking Plugin \u2013 LatePoint | Calendar \u0026 Scheduling for WordPress",
"vendor": "latepoint",
"versions": [
{
"lessThanOrEqual": "5.7.2",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Supakiad S. (m3ez)"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Appointment Booking Plugin \u2013 LatePoint | Calendar \u0026 Scheduling for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference / Missing Authorization in versions up to, and including, 5.7.2. This is due to the publicly reachable steps__start and steps__load_step routes accepting a params[presets][order_item_id] value that is copied verbatim into the booking object without verifying that the referenced order item belongs to the current customer, is a bundle item, is paid, or has remaining capacity \u2014 the is_bundle_scheduling() bundle discriminator is a mere !empty(order_item_id) truthiness check, and the code flow explicitly removes the customer and payment steps when this is truthy (the source even carries a TODO acknowledging the missing validation). This makes it possible for unauthenticated attackers to create approved appointments against other customers\u0027 order items and to read those customers\u0027 names, email addresses, and order codes returned in the booking confirmation."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639 Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-10T05:30:55.254Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/136f8e94-a09a-48c4-bea9-e8b21d3fd91f?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.6.11/lib/helpers/steps_helper.php#L1028"
},
{
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.6.11/lib/helpers/steps_helper.php#L1281"
},
{
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.6.11/lib/models/booking_model.php#L842"
},
{
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.6.11/lib/helpers/steps_helper.php#L677"
},
{
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.6.11/lib/helpers/steps_helper.php#L2350"
},
{
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.6.11/lib/controllers/steps_controller.php#L17"
},
{
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.6.11/lib/controllers/steps_controller.php#L341"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-14T17:30:15.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-10-09T17:18:27.000Z",
"value": "Disclosed"
}
],
"title": "Appointment Booking Plugin \u003c= 5.7.2 - Insecure Direct Object Reference to Authenticated (Subscriber+) Unauthorized Booking Creation and Sensitive Information Disclosure via \u0027params[presets][order_item_id]\u0027 Parameter"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-91050",
"datePublished": "2026-10-10T05:30:55.254Z",
"dateReserved": "2026-09-14T17:15:11.459Z",
"dateUpdated": "2026-10-11T16:55:18.699Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-104766 (GCVE-0-2026-104766)
Vulnerability from nvd – Published: 2026-10-10 05:30 – Updated: 2026-10-11 16:55
VLAI
EPSS
VEX
Title
Appointment Booking Plugin <= 5.7.3 - Authenticated (Custom+) Privilege Escalation to 'settings[default_wp_role_for_customer]' Parameter
Summary
The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 5.7.3. This is due to the `OsSettingsController::update()` handler iterating over attacker-supplied `settings` parameters without an allowlist of permitted setting names or values, and `OsSettingsHelper::prepare_value()` performing no role allowlist validation before persisting the `default_wp_role_for_customer` setting — a restriction that exists only in the UI dropdown and is never enforced server-side. This makes it possible for authenticated attackers holding a LatePoint role with the `settings__edit` capability (such as an agent or custom role) to overwrite the default WordPress role for new customers with `administrator`, causing any subsequently self-registered LatePoint customer account to be created with full WordPress administrator privileges. Exploitation requires that a WordPress administrator has granted the `settings__edit` capability to a LatePoint agent or custom role, and that a new customer account is registered through LatePoint after the malicious setting change is persisted.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-11 16:38 UTC
CWE
- CWE-269 - Improper Privilege Management
Assigner
References
6 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| latepoint | Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress |
Affected:
0 , ≤ 5.7.3
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-104766",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-11T16:38:26.953919Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-11T16:55:18.205Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Appointment Booking Plugin \u2013 LatePoint | Calendar \u0026 Scheduling for WordPress",
"vendor": "latepoint",
"versions": [
{
"lessThanOrEqual": "5.7.3",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Wordfence PRISM"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Appointment Booking Plugin \u2013 LatePoint | Calendar \u0026 Scheduling for WordPress plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 5.7.3. This is due to the `OsSettingsController::update()` handler iterating over attacker-supplied `settings` parameters without an allowlist of permitted setting names or values, and `OsSettingsHelper::prepare_value()` performing no role allowlist validation before persisting the `default_wp_role_for_customer` setting \u2014 a restriction that exists only in the UI dropdown and is never enforced server-side. This makes it possible for authenticated attackers holding a LatePoint role with the `settings__edit` capability (such as an agent or custom role) to overwrite the default WordPress role for new customers with `administrator`, causing any subsequently self-registered LatePoint customer account to be created with full WordPress administrator privileges. Exploitation requires that a WordPress administrator has granted the `settings__edit` capability to a LatePoint agent or custom role, and that a new customer account is registered through LatePoint after the malicious setting change is persisted."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-269",
"description": "CWE-269 Improper Privilege Management",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-10T05:30:57.307Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/38870e14-2e8f-4281-adb6-4be3b1d3d2ce?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.3/lib/controllers/settings_controller.php#L469"
},
{
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.3/lib/helpers/settings_helper.php#L754"
},
{
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.3/lib/helpers/customer_helper.php#L297"
},
{
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.3/lib/helpers/settings_helper.php#L953"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3728691%40latepoint\u0026new=3728691%40latepoint"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-02T12:55:22.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-10-09T17:19:05.000Z",
"value": "Disclosed"
}
],
"title": "Appointment Booking Plugin \u003c= 5.7.3 - Authenticated (Custom+) Privilege Escalation to \u0027settings[default_wp_role_for_customer]\u0027 Parameter"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-104766",
"datePublished": "2026-10-10T05:30:57.307Z",
"dateReserved": "2026-10-02T12:39:39.043Z",
"dateUpdated": "2026-10-11T16:55:18.205Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-17538 (GCVE-0-2026-17538)
Vulnerability from nvd – Published: 2026-10-07 23:27 – Updated: 2026-10-10 02:50
VLAI
EPSS
VEX
Title
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress <= 5.6.9 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Customer PII Modification
Summary
The LatePoint - Appointment Booking & Reservation plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 5.6.9. This is due to the process_step_customer() function using is_user_logged_in() as the sole gate before merging POSTed customer data into an existing LatePoint customer, without any ownership checks. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify the personal information (first name, last name, email, phone, notes) of arbitrary LatePoint customers, and, when the contact_merge setting is 'phone', to overwrite the victim's email address and take over the account via a password reset.
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-10 02:50 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| latepoint | Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress |
Affected:
0 , ≤ 5.6.9
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-17538",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-10T02:50:40.425401Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-10T02:50:49.302Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Appointment Booking Plugin \u2013 LatePoint | Calendar \u0026 Scheduling for WordPress",
"vendor": "latepoint",
"versions": [
{
"lessThanOrEqual": "5.6.9",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "owlmind"
}
],
"descriptions": [
{
"lang": "en",
"value": "The LatePoint - Appointment Booking \u0026 Reservation plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 5.6.9. This is due to the process_step_customer() function using is_user_logged_in() as the sole gate before merging POSTed customer data into an existing LatePoint customer, without any ownership checks. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify the personal information (first name, last name, email, phone, notes) of arbitrary LatePoint customers, and, when the contact_merge setting is \u0027phone\u0027, to overwrite the victim\u0027s email address and take over the account via a password reset."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639 Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T23:27:12.424Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/83cdc51f-b5e1-42b9-972a-7e781f97b43e?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3631493/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-06-22T00:00:00.000Z",
"value": "Discovered"
},
{
"lang": "en",
"time": "2026-07-27T09:51:30.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-10-07T11:12:20.000Z",
"value": "Disclosed"
}
],
"title": "Appointment Booking Plugin \u2013 LatePoint | Calendar \u0026 Scheduling for WordPress \u003c= 5.6.9 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Customer PII Modification"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-17538",
"datePublished": "2026-10-07T23:27:12.424Z",
"dateReserved": "2026-07-27T09:35:22.512Z",
"dateUpdated": "2026-10-10T02:50:49.302Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-94432 (GCVE-0-2026-94432)
Vulnerability from nvd – Published: 2026-10-02 07:39 – Updated: 2026-10-03 15:42
VLAI
EPSS
VEX
Title
Appointment Booking Plugin <= 5.7.1 - Insecure Direct Object Reference to Unauthenticated Unauthorized Transaction Intent Creation/Modification and Invoice Enumeration via 'invoice_id' Parameter
Summary
The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 5.7.1 via the OsPaypalConnectController::create_order_for_transaction() action registered as a public (unauthenticated) route through wp_ajax_nopriv_latepoint_route_call. The handler loads an OsInvoiceModel by a sequential integer 'invoice_id' with no access-key/UUID or ownership check (the sibling Stripe and Razorpay handlers require a 128-bit access-key UUID via OsInvoicesHelper::get_invoice_by_key), and then calls OsTransactionIntentHelper::create_or_update_transaction_intent() which persists a transaction intent tied to the target invoice's customer_id, order_id and charge_amount and regenerates its intent_key before the PayPal-configured guard is reached. This makes it possible for unauthenticated attackers to enumerate invoices belonging to arbitrary customers, create unauthorized transaction-intent rows linked to another customer's data, and overwrite the intent_key of any in-flight NEW-status transaction intent — invalidating the intent_key that legitimate Stripe/Razorpay flows are waiting on and breaking payment webhooks for those customers.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-03 15:29 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
7 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| latepoint | Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress |
Affected:
0 , ≤ 5.7.1
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-94432",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-03T15:29:06.542489Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-03T15:42:48.459Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Appointment Booking Plugin \u2013 LatePoint | Calendar \u0026 Scheduling for WordPress",
"vendor": "latepoint",
"versions": [
{
"lessThanOrEqual": "5.7.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Niv Kochan"
},
{
"lang": "en",
"type": "finder",
"value": "Matan Bachar"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Appointment Booking Plugin \u2013 LatePoint | Calendar \u0026 Scheduling for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 5.7.1 via the OsPaypalConnectController::create_order_for_transaction() action registered as a public (unauthenticated) route through wp_ajax_nopriv_latepoint_route_call. The handler loads an OsInvoiceModel by a sequential integer \u0027invoice_id\u0027 with no access-key/UUID or ownership check (the sibling Stripe and Razorpay handlers require a 128-bit access-key UUID via OsInvoicesHelper::get_invoice_by_key), and then calls OsTransactionIntentHelper::create_or_update_transaction_intent() which persists a transaction intent tied to the target invoice\u0027s customer_id, order_id and charge_amount and regenerates its intent_key before the PayPal-configured guard is reached. This makes it possible for unauthenticated attackers to enumerate invoices belonging to arbitrary customers, create unauthorized transaction-intent rows linked to another customer\u0027s data, and overwrite the intent_key of any in-flight NEW-status transaction intent \u2014 invalidating the intent_key that legitimate Stripe/Razorpay flows are waiting on and breaking payment webhooks for those customers."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639 Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-02T07:39:29.009Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e101bc4e-1c5d-4f30-a1eb-617b0db92723?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.0/lib/controllers/paypal_connect_controller.php#L31"
},
{
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.0/lib/controllers/paypal_connect_controller.php#L20"
},
{
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.0/lib/helpers/transaction_intent_helper.php#L85"
},
{
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.0/latepoint.php#L1072"
},
{
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.0/lib/controllers/controller.php#L57"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3709058%40latepoint\u0026new=3709058%40latepoint"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-21T16:21:24.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-10-01T19:14:41.000Z",
"value": "Disclosed"
}
],
"title": "Appointment Booking Plugin \u003c= 5.7.1 - Insecure Direct Object Reference to Unauthenticated Unauthorized Transaction Intent Creation/Modification and Invoice Enumeration via \u0027invoice_id\u0027 Parameter"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-94432",
"datePublished": "2026-10-02T07:39:29.009Z",
"dateReserved": "2026-09-21T16:06:17.998Z",
"dateUpdated": "2026-10-03T15:42:48.459Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-92966 (GCVE-0-2026-92966)
Vulnerability from nvd – Published: 2026-10-01 04:27 – Updated: 2026-10-01 14:17
VLAI
EPSS
VEX
Title
Appointment Booking Plugin <= 5.7.0 - Unauthenticated Arbitrary Shortcode Execution via First/Last Name Field
Summary
The The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.7.0. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. The payload is planted during the unauthenticated booking flow and triggered when the Customer Cabinet block rendered by render_customer_dashboard() outputs the stored name into the content stream, where WordPress core's do_shortcode filter at priority 11 re-parses and executes it.
Severity
9.1 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-01 14:17 UTC
CWE
- CWE-94 - Improper Control of Generation of Code ('Code Injection')
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| latepoint | Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress |
Affected:
0 , ≤ 5.7.0
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-92966",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-01T14:17:22.790468Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-01T14:17:31.516Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Appointment Booking Plugin \u2013 LatePoint | Calendar \u0026 Scheduling for WordPress",
"vendor": "latepoint",
"versions": [
{
"lessThanOrEqual": "5.7.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "hashiramasenju333"
}
],
"descriptions": [
{
"lang": "en",
"value": "The The Appointment Booking Plugin \u2013 LatePoint | Calendar \u0026 Scheduling for WordPress plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.7.0. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. The payload is planted during the unauthenticated booking flow and triggered when the Customer Cabinet block rendered by render_customer_dashboard() outputs the stored name into the content stream, where WordPress core\u0027s do_shortcode filter at priority 11 re-parses and executes it."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-01T04:27:34.115Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c9a030c0-6129-40b0-81da-4c420929d198?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.0/lib/helpers/blocks_helper.php#L234"
},
{
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.0/lib/views/customer_cabinet/dashboard.php#L19"
},
{
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.0/lib/models/customer_model.php#L386"
},
{
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.1/lib/helpers/blocks_helper.php"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-17T13:25:38.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-09-30T15:46:49.000Z",
"value": "Disclosed"
}
],
"title": "Appointment Booking Plugin \u003c= 5.7.0 - Unauthenticated Arbitrary Shortcode Execution via First/Last Name Field"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-92966",
"datePublished": "2026-10-01T04:27:34.115Z",
"dateReserved": "2026-09-17T13:10:34.409Z",
"dateUpdated": "2026-10-01T14:17:31.516Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-13471 (GCVE-0-2026-13471)
Vulnerability from nvd – Published: 2026-09-18 07:40 – Updated: 2026-09-18 19:58
VLAI
EPSS
VEX
Title
LatePoint <= 5.6.3 - Authenticated (Custom+) Insecure Direct Object Reference to Arbitrary Booking Deletion and Customer/Booking Data Disclosure via Abilities REST API (list-bookings, list-customers, delete-booking)
Summary
The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.6.3 via the LatePointAbilityDeleteBooking::execute due to missing validation on a user controlled key. This makes it possible for attackers, with LatePoint Agent-level access and above, to read bookings and customer PII (full name, email, phone, and notes) assigned to other LatePoint agents, and delete arbitrary bookings by supplying any booking ID. This vulnerability is only exploitable when an administrator has enabled the Abilities API toggles (latepoint_abilities_api, latepoint_abilities_api_delete, and/or latepoint_abilities_api_edit) in the plugin settings.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-18 19:57 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
14 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| latepoint | Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress |
Affected:
0 , ≤ 5.6.3
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-13471",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-18T19:57:24.068567Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T19:58:00.084Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Appointment Booking Plugin \u2013 LatePoint | Calendar \u0026 Scheduling for WordPress",
"vendor": "latepoint",
"versions": [
{
"lessThanOrEqual": "5.6.3",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "skyv3il"
},
{
"lang": "en",
"type": "finder",
"value": "Chirita Catalin-Andrei (CC99IE)"
},
{
"lang": "en",
"type": "finder",
"value": "AmonRa"
},
{
"lang": "en",
"type": "finder",
"value": "MrProperCTF"
}
],
"descriptions": [
{
"lang": "en",
"value": "The LatePoint \u2013 Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.6.3 via the LatePointAbilityDeleteBooking::execute due to missing validation on a user controlled key. This makes it possible for attackers, with LatePoint Agent-level access and above, to read bookings and customer PII (full name, email, phone, and notes) assigned to other LatePoint agents, and delete arbitrary bookings by supplying any booking ID. This vulnerability is only exploitable when an administrator has enabled the Abilities API toggles (latepoint_abilities_api, latepoint_abilities_api_delete, and/or latepoint_abilities_api_edit) in the plugin settings."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639 Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T07:40:00.105Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/448df3b0-32a7-4097-a37d-07e253993496?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.6.3/lib/abilities/bookings/delete-booking.php#L47"
},
{
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.6.3/lib/abilities/bookings/list-bookings.php#L50"
},
{
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.6.3/lib/abilities/customers/list-customers.php#L78"
},
{
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.6.3/lib/abilities/bookings/abstract-booking-ability.php#L34"
},
{
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.6.3/lib/abilities/abstract-ability.php#L55"
},
{
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.6.3/lib/abilities/class-latepoint-abilities.php#L77"
},
{
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.4.2/lib/abilities/bookings/delete-booking.php#L47"
},
{
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.4.2/lib/abilities/bookings/list-bookings.php#L50"
},
{
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.4.2/lib/abilities/customers/list-customers.php#L78"
},
{
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.4.2/lib/abilities/bookings/abstract-booking-ability.php#L34"
},
{
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.4.2/lib/abilities/abstract-ability.php#L55"
},
{
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.4.2/lib/abilities/class-latepoint-abilities.php#L77"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026new=3590914%40latepoint\u0026old=3584059%40latepoint"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-06-26T21:28:56.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-09-17T19:13:36.000Z",
"value": "Disclosed"
}
],
"title": "LatePoint \u003c= 5.6.3 - Authenticated (Custom+) Insecure Direct Object Reference to Arbitrary Booking Deletion and Customer/Booking Data Disclosure via Abilities REST API (list-bookings, list-customers, delete-booking)"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-13471",
"datePublished": "2026-09-18T07:40:00.105Z",
"dateReserved": "2026-06-26T21:13:39.703Z",
"dateUpdated": "2026-09-18T19:58:00.084Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-18441 (GCVE-0-2026-18441)
Vulnerability from nvd – Published: 2026-09-17 23:27 – Updated: 2026-09-19 14:21
VLAI
EPSS
VEX
Title
LatePoint - Appointment Booking & Scheduling <= 5.6.9 - Unauthenticated Insecure Direct Object Reference to Sensitive Information Disclosure via 'customer[id]' Parameter
Summary
The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.6.9 via the set_customer_object due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to enumerate arbitrary customer records and disclose personally identifiable information - including first name, last name, email address, and phone number - by iterating the customer[id] parameter. This issue is exploitable only when the site is configured with customer authentication disabled (guest checkout enabled).
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-19 13:19 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| latepoint | Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress |
Affected:
0 , ≤ 5.6.9
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-18441",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-19T13:19:23.665831Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-19T14:21:52.663Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Appointment Booking Plugin \u2013 LatePoint | Calendar \u0026 Scheduling for WordPress",
"vendor": "latepoint",
"versions": [
{
"lessThanOrEqual": "5.6.9",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Sorra"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Appointment Booking Plugin \u2013 LatePoint | Calendar \u0026 Scheduling for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.6.9 via the set_customer_object due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to enumerate arbitrary customer records and disclose personally identifiable information - including first name, last name, email address, and phone number - by iterating the customer[id] parameter. This issue is exploitable only when the site is configured with customer authentication disabled (guest checkout enabled)."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639 Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-17T23:27:10.903Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d80ed885-43f8-43a4-bc61-e9ef92e3207e?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.6.9/lib/helpers/steps_helper.php#L1184"
},
{
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.6.9/lib/models/model.php#L574"
},
{
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.6.9/lib/controllers/steps_controller.php#L341"
},
{
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.6.9/latepoint.php#L1006"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-06-25T00:00:00.000Z",
"value": "Discovered"
},
{
"lang": "en",
"time": "2026-07-30T21:03:15.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-09-17T10:58:18.000Z",
"value": "Disclosed"
}
],
"title": "LatePoint - Appointment Booking \u0026 Scheduling \u003c= 5.6.9 - Unauthenticated Insecure Direct Object Reference to Sensitive Information Disclosure via \u0027customer[id]\u0027 Parameter"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-18441",
"datePublished": "2026-09-17T23:27:10.903Z",
"dateReserved": "2026-07-30T20:33:41.814Z",
"dateUpdated": "2026-09-19T14:21:52.663Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-5391 (GCVE-0-2026-5391)
Vulnerability from nvd – Published: 2026-08-06 11:29 – Updated: 2026-08-06 15:37
VLAI
EPSS
VEX
Title
LatePoint <= 5.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Summary
The LatePoint plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'btn_wrapper_classes' attribute of the 'latepoint_resources' shortcode in all versions up to, and including, 5.3.2. This is due to insufficient input sanitization and output escaping in the 'locations' branch of the 'shortcode_latepoint_resources' function. This makes it possible for authenticated attackers, with contributor level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Severity
6.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-06 15:26 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| latepoint | Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress |
Affected:
0 , ≤ 5.3.2
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-5391",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-06T15:26:23.983373Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-06T15:37:10.544Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Appointment Booking Plugin \u2013 LatePoint | Calendar \u0026 Scheduling for WordPress",
"vendor": "latepoint",
"versions": [
{
"lessThanOrEqual": "5.3.2",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "alex_henry20"
}
],
"descriptions": [
{
"lang": "en",
"value": "The LatePoint plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u0027btn_wrapper_classes\u0027 attribute of the \u0027latepoint_resources\u0027 shortcode in all versions up to, and including, 5.3.2. This is due to insufficient input sanitization and output escaping in the \u0027locations\u0027 branch of the \u0027shortcode_latepoint_resources\u0027 function. This makes it possible for authenticated attackers, with contributor level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-06T11:29:19.969Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/25ea860e-c4f8-4660-a8cb-aafc4d02bb19?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3505127/latepoint/trunk/lib/helpers/shortcodes_helper.php"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-03-20T00:00:00.000Z",
"value": "Discovered"
},
{
"lang": "en",
"time": "2026-04-01T23:25:08.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-08-05T22:11:54.000Z",
"value": "Disclosed"
}
],
"title": "LatePoint \u003c= 5.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-5391",
"datePublished": "2026-08-06T11:29:19.969Z",
"dateReserved": "2026-04-01T23:08:21.183Z",
"dateUpdated": "2026-08-06T15:37:10.544Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-57714 (GCVE-0-2026-57714)
Vulnerability from nvd – Published: 2026-07-13 08:41 – Updated: 2026-07-13 13:30
VLAI
EPSS
VEX
Title
WordPress LatePoint plugin <= 5.6.3 - SQL Injection vulnerability
Summary
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LatePoint LatePoint latepoint allows Blind SQL Injection.This issue affects LatePoint: from n/a through <= 5.6.3.
Severity
9.3 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-13 13:30 UTC
CWE
- CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://patchstack.com/database/Wordpress/Plugin/… | vdb-entry |
Impacted products
Date Public
2026-07-13 10:37
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-57714",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-13T13:30:47.245873Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-13T13:30:52.769Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"packageName": "latepoint",
"product": "LatePoint",
"vendor": "LatePoint",
"versions": [
{
"changes": [
{
"at": "5.6.4",
"status": "unaffected"
}
],
"lessThanOrEqual": "5.6.3",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "daroo | Patchstack Bug Bounty Program"
}
],
"datePublic": "2026-07-13T10:37:38.097Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027) vulnerability in LatePoint LatePoint latepoint allows Blind SQL Injection.\u003cp\u003eThis issue affects LatePoint: from n/a through \u003c= 5.6.3.\u003c/p\u003e"
}
],
"value": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027) vulnerability in LatePoint LatePoint latepoint allows Blind SQL Injection.This issue affects LatePoint: from n/a through \u003c= 5.6.3."
}
],
"impacts": [
{
"capecId": "CAPEC-7",
"descriptions": [
{
"lang": "en",
"value": "Blind SQL Injection"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-13T08:41:24.759Z",
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack"
},
"references": [
{
"tags": [
"vdb-entry"
],
"url": "https://patchstack.com/database/Wordpress/Plugin/latepoint/vulnerability/wordpress-latepoint-plugin-5-6-3-sql-injection-vulnerability?_s_id=cve"
}
],
"title": "WordPress LatePoint plugin \u003c= 5.6.3 - SQL Injection vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"assignerShortName": "Patchstack",
"cveId": "CVE-2026-57714",
"datePublished": "2026-07-13T08:41:24.759Z",
"dateReserved": "2026-06-25T08:04:04.790Z",
"dateUpdated": "2026-07-13T13:30:52.769Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111602 (GCVE-0-2026-111602)
Vulnerability from cvelistv5 – Published: 2026-10-17 02:31 – Updated: 2026-10-18 11:22
VLAI
EPSS
VEX
Title
Appointment Booking Plugin <= 5.7.4 - Unauthenticated Sensitive Information Disclosure via ORM Operator Injection in 'customer[uuid]' Parameter
Summary
The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.7.4 via the 'params (customer[uuid])' parameter. This makes it possible for unauthenticated attackers to extract the first name, last name, email address, phone number, and notes of every customer record in the database by enumerating uuid prefixes via the unauthenticated steps__load_step AJAX endpoint. This vulnerability is only exploitable when the LatePoint plugin is configured with the 'Field used for authentication' setting set to 'Disable ability to login' (guest checkout mode).
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-18 11:09 UTC
CWE
- CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
Assigner
References
6 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| latepoint | Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress |
Affected:
0 , ≤ 5.7.4
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-111602",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-18T11:09:30.558764Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-18T11:22:47.696Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Appointment Booking Plugin \u2013 LatePoint | Calendar \u0026 Scheduling for WordPress",
"vendor": "latepoint",
"versions": [
{
"lessThanOrEqual": "5.7.4",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Ji\u0159\u00ed Fryjauf (jfryjauf)"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Appointment Booking Plugin \u2013 LatePoint | Calendar \u0026 Scheduling for WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.7.4 via the \u0027params (customer[uuid])\u0027 parameter. This makes it possible for unauthenticated attackers to extract the first name, last name, email address, phone number, and notes of every customer record in the database by enumerating uuid prefixes via the unauthenticated steps__load_step AJAX endpoint. This vulnerability is only exploitable when the LatePoint plugin is configured with the \u0027Field used for authentication\u0027 setting set to \u0027Disable ability to login\u0027 (guest checkout mode)."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 3.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-17T02:31:07.048Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6afce24f-30cd-4aeb-a5dd-20bd80a75779?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.4/lib/helpers/steps_helper.php#L1175"
},
{
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.4/lib/controllers/steps_controller.php#L355"
},
{
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.4/lib/models/model.php#L379"
},
{
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.4/lib/helpers/params_helper.php#L14"
},
{
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.5/lib/controllers/steps_controller.php"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-08T22:13:58.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-10-16T14:30:46.000Z",
"value": "Disclosed"
}
],
"title": "Appointment Booking Plugin \u003c= 5.7.4 - Unauthenticated Sensitive Information Disclosure via ORM Operator Injection in \u0027customer[uuid]\u0027 Parameter"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-111602",
"datePublished": "2026-10-17T02:31:07.048Z",
"dateReserved": "2026-10-16T14:30:12.558Z",
"dateUpdated": "2026-10-18T11:22:47.696Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-110653 (GCVE-0-2026-110653)
Vulnerability from cvelistv5 – Published: 2026-10-17 02:31 – Updated: 2026-10-18 11:22
VLAI
EPSS
VEX
Title
Appointment Booking Plugin <= 5.7.4 - Unauthenticated Authentication Bypass via Race Condition on OTP Attempts Counter
Summary
The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Authentication Bypass via Race Condition in all versions up to, and including, 5.7.4. This is due to a non-atomic read-modify-write on the OTP verification attempts counter in the `verifyOTP` function: the counter is incremented using a stale in-memory value with no conditional `WHERE attempts < 10` guard on the `UPDATE` and no `SELECT ... FOR UPDATE` row lock, creating a TOCTOU window that allows concurrent requests to bypass the 10-attempt lockout. This makes it possible for unauthenticated attackers — who know a target customer's registered email address or phone number — to fire concurrent requests to the `auth__verify_otp` endpoint, defeat the lockout cap, brute-force the 6-digit OTP code, and authenticate as the targeted LatePoint customer, gaining full access to their account, bookings, and personal data. The nonce check present on the endpoint (`otp_verify_otp_nonce`) does not mitigate this issue, as the nonce is publicly emitted by the unauthenticated `request_otp` and `resend_otp` endpoints and is trivially obtainable by any unauthenticated attacker prior to launching the race.
Severity
9.1 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-18 11:09 UTC
CWE
- CWE-287 - Improper Authentication
Assigner
References
7 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| latepoint | Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress |
Affected:
0 , ≤ 5.7.4
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-110653",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-18T11:09:42.337028Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-18T11:22:47.841Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Appointment Booking Plugin \u2013 LatePoint | Calendar \u0026 Scheduling for WordPress",
"vendor": "latepoint",
"versions": [
{
"lessThanOrEqual": "5.7.4",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Ekene Umegakwe"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Appointment Booking Plugin \u2013 LatePoint | Calendar \u0026 Scheduling for WordPress plugin for WordPress is vulnerable to Authentication Bypass via Race Condition in all versions up to, and including, 5.7.4. This is due to a non-atomic read-modify-write on the OTP verification attempts counter in the `verifyOTP` function: the counter is incremented using a stale in-memory value with no conditional `WHERE attempts \u003c 10` guard on the `UPDATE` and no `SELECT ... FOR UPDATE` row lock, creating a TOCTOU window that allows concurrent requests to bypass the 10-attempt lockout. This makes it possible for unauthenticated attackers \u2014 who know a target customer\u0027s registered email address or phone number \u2014 to fire concurrent requests to the `auth__verify_otp` endpoint, defeat the lockout cap, brute-force the 6-digit OTP code, and authenticate as the targeted LatePoint customer, gaining full access to their account, bookings, and personal data. The nonce check present on the endpoint (`otp_verify_otp_nonce`) does not mitigate this issue, as the nonce is publicly emitted by the unauthenticated `request_otp` and `resend_otp` endpoints and is trivially obtainable by any unauthenticated attacker prior to launching the race."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "CWE-287 Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-17T02:31:06.697Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/61fbc1dd-06c9-409b-8cad-3f350b38dfc3?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.4/lib/helpers/otp_helper.php#L228"
},
{
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.4/lib/helpers/otp_helper.php#L185"
},
{
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.4/lib/controllers/auth_controller.php#L30"
},
{
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.4/lib/controllers/auth_controller.php#L14"
},
{
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.4/lib/models/model.php#L773"
},
{
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.5/lib/helpers/otp_helper.php"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-14T13:23:22.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-10-16T14:24:52.000Z",
"value": "Disclosed"
}
],
"title": "Appointment Booking Plugin \u003c= 5.7.4 - Unauthenticated Authentication Bypass via Race Condition on OTP Attempts Counter"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-110653",
"datePublished": "2026-10-17T02:31:06.697Z",
"dateReserved": "2026-10-14T13:08:07.307Z",
"dateUpdated": "2026-10-18T11:22:47.841Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-103380 (GCVE-0-2026-103380)
Vulnerability from cvelistv5 – Published: 2026-10-14 07:43 – Updated: 2026-10-15 16:43
VLAI
EPSS
VEX
Title
Appointment Booking Plugin <= 5.7.3 - Authenticated (Subscriber+) Sensitive Information Exposure in 'first_name' Parameter Template Re-expansion
Summary
The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.7.3 via the 'params[customer][first_name]' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract privileged booking data including the administrator-only admin_notes field, assigned agent internal contact details, transaction tokens, and payment request URLs delivered via rendered notification emails. A LatePoint customer can exploit this by storing a template placeholder such as {{customer_admin_notes}} in their own first_name field via the customer_cabinet__update route, then triggering the password-reset email flow to receive the expanded value in the resulting notification.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-15 10:52 UTC
CWE
- CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
Assigner
References
7 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| latepoint | Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress |
Affected:
0 , ≤ 5.7.3
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-103380",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-15T10:52:24.378589Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T16:43:49.346Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Appointment Booking Plugin \u2013 LatePoint | Calendar \u0026 Scheduling for WordPress",
"vendor": "latepoint",
"versions": [
{
"lessThanOrEqual": "5.7.3",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "walid213"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Appointment Booking Plugin \u2013 LatePoint | Calendar \u0026 Scheduling for WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.7.3 via the \u0027params[customer][first_name]\u0027 parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract privileged booking data including the administrator-only admin_notes field, assigned agent internal contact details, transaction tokens, and payment request URLs delivered via rendered notification emails. A LatePoint customer can exploit this by storing a template placeholder such as {{customer_admin_notes}} in their own first_name field via the customer_cabinet__update route, then triggering the password-reset email flow to receive the expanded value in the resulting notification."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T07:43:32.242Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4494960c-66ed-47d9-b3fc-5a5ec5a07b1f?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.3/lib/helpers/replacer_helper.php#L278"
},
{
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.3/lib/helpers/replacer_helper.php#L614"
},
{
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.3/lib/controllers/customer_cabinet_controller.php#L321"
},
{
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.3/lib/models/customer_model.php#L388"
},
{
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.3/lib/mailers/customer_mailer.php#L33"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3728691%40latepoint\u0026new=3728691%40latepoint"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-30T13:29:47.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-10-13T19:18:51.000Z",
"value": "Disclosed"
}
],
"title": "Appointment Booking Plugin \u003c= 5.7.3 - Authenticated (Subscriber+) Sensitive Information Exposure in \u0027first_name\u0027 Parameter Template Re-expansion"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-103380",
"datePublished": "2026-10-14T07:43:32.242Z",
"dateReserved": "2026-09-30T13:14:36.283Z",
"dateUpdated": "2026-10-15T16:43:49.346Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-103366 (GCVE-0-2026-103366)
Vulnerability from cvelistv5 – Published: 2026-10-14 07:43 – Updated: 2026-10-15 16:43
VLAI
EPSS
VEX
Title
Appointment Booking Plugin <= 5.7.3 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'booking[id]' and 'cart[id]' Parameters
Summary
The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 5.7.3 via the `booking[id]` and `cart[id]` parameters on the `steps__reload_booking_form_summary_panel` and `steps__start` public routes (reachable through wp_ajax_nopriv_latepoint_route_call). This is due to `OsStepsHelper::set_required_objects()` feeding raw request parameters into `set_booking_object()` and `set_cart_object()`, which call `OsModel::set_data()` and load an arbitrary booking or cart row by primary key with no ownership check — the ownership guard the vendor added for the earlier disclosure lives only inside `OsStepsHelper::load_step()` and does not cover the sibling routes or `cart[id]` at all. This makes it possible for unauthenticated attackers to enumerate sequential booking / cart identifiers and read other customers' appointment details (service name, agent, date/time, duration, price breakdown, status) and other shoppers' pending checkout contents directly from the JSON responses.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-15 10:47 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
9 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| latepoint | Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress |
Affected:
0 , ≤ 5.7.3
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-103366",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-15T10:47:08.354377Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T16:43:49.470Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Appointment Booking Plugin \u2013 LatePoint | Calendar \u0026 Scheduling for WordPress",
"vendor": "latepoint",
"versions": [
{
"lessThanOrEqual": "5.7.3",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "churchill11"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Appointment Booking Plugin \u2013 LatePoint | Calendar \u0026 Scheduling for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 5.7.3 via the `booking[id]` and `cart[id]` parameters on the `steps__reload_booking_form_summary_panel` and `steps__start` public routes (reachable through wp_ajax_nopriv_latepoint_route_call). This is due to `OsStepsHelper::set_required_objects()` feeding raw request parameters into `set_booking_object()` and `set_cart_object()`, which call `OsModel::set_data()` and load an arbitrary booking or cart row by primary key with no ownership check \u2014 the ownership guard the vendor added for the earlier disclosure lives only inside `OsStepsHelper::load_step()` and does not cover the sibling routes or `cart[id]` at all. This makes it possible for unauthenticated attackers to enumerate sequential booking / cart identifiers and read other customers\u0027 appointment details (service name, agent, date/time, duration, price breakdown, status) and other shoppers\u0027 pending checkout contents directly from the JSON responses."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639 Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T07:43:31.890Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2f13d1ac-d1b4-4802-bee2-3622e84d7482?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.3/lib/helpers/steps_helper.php#L1232"
},
{
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.3/lib/helpers/steps_helper.php#L3228"
},
{
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.3/lib/models/model.php#L580"
},
{
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.3/lib/controllers/steps_controller.php#L145"
},
{
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.3/lib/controllers/steps_controller.php#L290"
},
{
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.3/lib/helpers/steps_helper.php#L234"
},
{
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.3/latepoint.php#L1072"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3728691%40latepoint\u0026new=3728691%40latepoint"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-30T13:16:23.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-10-13T19:19:27.000Z",
"value": "Disclosed"
}
],
"title": "Appointment Booking Plugin \u003c= 5.7.3 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via \u0027booking[id]\u0027 and \u0027cart[id]\u0027 Parameters"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-103366",
"datePublished": "2026-10-14T07:43:31.890Z",
"dateReserved": "2026-09-30T12:59:59.590Z",
"dateUpdated": "2026-10-15T16:43:49.470Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-100163 (GCVE-0-2026-100163)
Vulnerability from cvelistv5 – Published: 2026-10-14 07:43 – Updated: 2026-10-14 17:41
VLAI
EPSS
VEX
Title
Appointment Booking Plugin <= 5.7.2 - Unauthenticated Authentication Bypass to Customer Account Takeover via Insufficient Verification in create_wp_user_for_customer() username_exists Fallback
Summary
The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 5.7.2 via the OsCustomerHelper::create_wp_user_for_customer() helper reached from the public process_step_customer() booking step. When the 'Use WordPress users as customers' option is enabled, the helper falls back from email_exists() to username_exists( $customer->email ), which matches any WordPress user whose user_login equals the victim customer's email even when that user's user_email is completely different, and links that WordPress user's ID into the victim's LatePoint customer row (only privileged roles are excluded; Subscriber is allowed). This makes it possible for authenticated attackers, with Subscriber-level access and above, to take over another customer's LatePoint account — accessing their bookings, service, agent, and calendar data, and having the victim customer's email overwritten with the attacker's on next login — by holding a Subscriber account whose user_login equals the victim's email and submitting an unauthenticated public booking step registration request.
Severity
7.4 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-14 17:40 UTC
CWE
- CWE-287 - Improper Authentication
Assigner
References
7 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| latepoint | Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress |
Affected:
0 , ≤ 5.7.2
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-100163",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-14T17:40:58.748355Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T17:41:31.054Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Appointment Booking Plugin \u2013 LatePoint | Calendar \u0026 Scheduling for WordPress",
"vendor": "latepoint",
"versions": [
{
"lessThanOrEqual": "5.7.2",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "OKISO"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Appointment Booking Plugin \u2013 LatePoint | Calendar \u0026 Scheduling for WordPress plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 5.7.2 via the OsCustomerHelper::create_wp_user_for_customer() helper reached from the public process_step_customer() booking step. When the \u0027Use WordPress users as customers\u0027 option is enabled, the helper falls back from email_exists() to username_exists( $customer-\u003eemail ), which matches any WordPress user whose user_login equals the victim customer\u0027s email even when that user\u0027s user_email is completely different, and links that WordPress user\u0027s ID into the victim\u0027s LatePoint customer row (only privileged roles are excluded; Subscriber is allowed). This makes it possible for authenticated attackers, with Subscriber-level access and above, to take over another customer\u0027s LatePoint account \u2014 accessing their bookings, service, agent, and calendar data, and having the victim customer\u0027s email overwritten with the attacker\u0027s on next login \u2014 by holding a Subscriber account whose user_login equals the victim\u0027s email and submitting an unauthenticated public booking step registration request."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "CWE-287 Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T07:43:31.547Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2a942d71-7172-4e02-9faa-3a2c1c9e7fbd?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.2/lib/helpers/customer_helper.php#L259"
},
{
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.2/lib/helpers/customer_helper.php#L274"
},
{
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.2/lib/helpers/steps_helper.php#L2156"
},
{
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.2/lib/helpers/steps_helper.php#L2146"
},
{
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.2/latepoint.php#L1072"
},
{
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.3/lib/helpers/customer_helper.php"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-25T12:49:14.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-10-13T19:19:40.000Z",
"value": "Disclosed"
}
],
"title": "Appointment Booking Plugin \u003c= 5.7.2 - Unauthenticated Authentication Bypass to Customer Account Takeover via Insufficient Verification in create_wp_user_for_customer() username_exists Fallback"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-100163",
"datePublished": "2026-10-14T07:43:31.547Z",
"dateReserved": "2026-09-25T12:34:07.288Z",
"dateUpdated": "2026-10-14T17:41:31.054Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-96662 (GCVE-0-2026-96662)
Vulnerability from cvelistv5 – Published: 2026-10-10 07:41 – Updated: 2026-10-11 16:55
VLAI
EPSS
VEX
Title
Appointment Booking Plugin <= 5.7.2 - Unauthenticated SQL Injection via 'booking[service_id]' Parameter
Summary
The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to generic SQL Injection via 'booking[service_id]' Parameter in all versions up to, and including, 5.7.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-11 16:39 UTC
CWE
- CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Assigner
References
9 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| latepoint | Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress |
Affected:
0 , ≤ 5.7.2
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-96662",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-11T16:39:57.704939Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-11T16:55:15.993Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Appointment Booking Plugin \u2013 LatePoint | Calendar \u0026 Scheduling for WordPress",
"vendor": "latepoint",
"versions": [
{
"lessThanOrEqual": "5.7.2",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "zickzick2"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Appointment Booking Plugin \u2013 LatePoint | Calendar \u0026 Scheduling for WordPress plugin for WordPress is vulnerable to generic SQL Injection via \u0027booking[service_id]\u0027 Parameter in all versions up to, and including, 5.7.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-10T07:41:43.527Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/18c1a5a0-dee0-45ee-9e8b-0937b392eccd?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.1/lib/models/model.php#L403"
},
{
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.1/lib/helpers/connector_helper.php#L212"
},
{
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.1/lib/helpers/steps_helper.php#L1825"
},
{
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.1/lib/helpers/steps_helper.php#L1231"
},
{
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.1/lib/controllers/steps_controller.php#L356"
},
{
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.1/lib/controllers/steps_controller.php#L22"
},
{
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.1/latepoint.php#L1072"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3718438%40latepoint\u0026new=3718438%40latepoint"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-23T15:06:47.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-10-09T19:23:35.000Z",
"value": "Disclosed"
}
],
"title": "Appointment Booking Plugin \u003c= 5.7.2 - Unauthenticated SQL Injection via \u0027booking[service_id]\u0027 Parameter"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-96662",
"datePublished": "2026-10-10T07:41:43.527Z",
"dateReserved": "2026-09-23T14:51:55.113Z",
"dateUpdated": "2026-10-11T16:55:15.993Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-104766 (GCVE-0-2026-104766)
Vulnerability from cvelistv5 – Published: 2026-10-10 05:30 – Updated: 2026-10-11 16:55
VLAI
EPSS
VEX
Title
Appointment Booking Plugin <= 5.7.3 - Authenticated (Custom+) Privilege Escalation to 'settings[default_wp_role_for_customer]' Parameter
Summary
The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 5.7.3. This is due to the `OsSettingsController::update()` handler iterating over attacker-supplied `settings` parameters without an allowlist of permitted setting names or values, and `OsSettingsHelper::prepare_value()` performing no role allowlist validation before persisting the `default_wp_role_for_customer` setting — a restriction that exists only in the UI dropdown and is never enforced server-side. This makes it possible for authenticated attackers holding a LatePoint role with the `settings__edit` capability (such as an agent or custom role) to overwrite the default WordPress role for new customers with `administrator`, causing any subsequently self-registered LatePoint customer account to be created with full WordPress administrator privileges. Exploitation requires that a WordPress administrator has granted the `settings__edit` capability to a LatePoint agent or custom role, and that a new customer account is registered through LatePoint after the malicious setting change is persisted.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-11 16:38 UTC
CWE
- CWE-269 - Improper Privilege Management
Assigner
References
6 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| latepoint | Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress |
Affected:
0 , ≤ 5.7.3
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-104766",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-11T16:38:26.953919Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-11T16:55:18.205Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Appointment Booking Plugin \u2013 LatePoint | Calendar \u0026 Scheduling for WordPress",
"vendor": "latepoint",
"versions": [
{
"lessThanOrEqual": "5.7.3",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Wordfence PRISM"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Appointment Booking Plugin \u2013 LatePoint | Calendar \u0026 Scheduling for WordPress plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 5.7.3. This is due to the `OsSettingsController::update()` handler iterating over attacker-supplied `settings` parameters without an allowlist of permitted setting names or values, and `OsSettingsHelper::prepare_value()` performing no role allowlist validation before persisting the `default_wp_role_for_customer` setting \u2014 a restriction that exists only in the UI dropdown and is never enforced server-side. This makes it possible for authenticated attackers holding a LatePoint role with the `settings__edit` capability (such as an agent or custom role) to overwrite the default WordPress role for new customers with `administrator`, causing any subsequently self-registered LatePoint customer account to be created with full WordPress administrator privileges. Exploitation requires that a WordPress administrator has granted the `settings__edit` capability to a LatePoint agent or custom role, and that a new customer account is registered through LatePoint after the malicious setting change is persisted."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-269",
"description": "CWE-269 Improper Privilege Management",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-10T05:30:57.307Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/38870e14-2e8f-4281-adb6-4be3b1d3d2ce?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.3/lib/controllers/settings_controller.php#L469"
},
{
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.3/lib/helpers/settings_helper.php#L754"
},
{
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.3/lib/helpers/customer_helper.php#L297"
},
{
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.3/lib/helpers/settings_helper.php#L953"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3728691%40latepoint\u0026new=3728691%40latepoint"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-02T12:55:22.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-10-09T17:19:05.000Z",
"value": "Disclosed"
}
],
"title": "Appointment Booking Plugin \u003c= 5.7.3 - Authenticated (Custom+) Privilege Escalation to \u0027settings[default_wp_role_for_customer]\u0027 Parameter"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-104766",
"datePublished": "2026-10-10T05:30:57.307Z",
"dateReserved": "2026-10-02T12:39:39.043Z",
"dateUpdated": "2026-10-11T16:55:18.205Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-91050 (GCVE-0-2026-91050)
Vulnerability from cvelistv5 – Published: 2026-10-10 05:30 – Updated: 2026-10-11 16:55
VLAI
EPSS
VEX
Title
Appointment Booking Plugin <= 5.7.2 - Insecure Direct Object Reference to Authenticated (Subscriber+) Unauthorized Booking Creation and Sensitive Information Disclosure via 'params[presets][order_item_id]' Parameter
Summary
The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference / Missing Authorization in versions up to, and including, 5.7.2. This is due to the publicly reachable steps__start and steps__load_step routes accepting a params[presets][order_item_id] value that is copied verbatim into the booking object without verifying that the referenced order item belongs to the current customer, is a bundle item, is paid, or has remaining capacity — the is_bundle_scheduling() bundle discriminator is a mere !empty(order_item_id) truthiness check, and the code flow explicitly removes the customer and payment steps when this is truthy (the source even carries a TODO acknowledging the missing validation). This makes it possible for unauthenticated attackers to create approved appointments against other customers' order items and to read those customers' names, email addresses, and order codes returned in the booking confirmation.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-11 16:41 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
8 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| latepoint | Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress |
Affected:
0 , ≤ 5.7.2
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-91050",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-11T16:41:31.200374Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-11T16:55:18.699Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Appointment Booking Plugin \u2013 LatePoint | Calendar \u0026 Scheduling for WordPress",
"vendor": "latepoint",
"versions": [
{
"lessThanOrEqual": "5.7.2",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Supakiad S. (m3ez)"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Appointment Booking Plugin \u2013 LatePoint | Calendar \u0026 Scheduling for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference / Missing Authorization in versions up to, and including, 5.7.2. This is due to the publicly reachable steps__start and steps__load_step routes accepting a params[presets][order_item_id] value that is copied verbatim into the booking object without verifying that the referenced order item belongs to the current customer, is a bundle item, is paid, or has remaining capacity \u2014 the is_bundle_scheduling() bundle discriminator is a mere !empty(order_item_id) truthiness check, and the code flow explicitly removes the customer and payment steps when this is truthy (the source even carries a TODO acknowledging the missing validation). This makes it possible for unauthenticated attackers to create approved appointments against other customers\u0027 order items and to read those customers\u0027 names, email addresses, and order codes returned in the booking confirmation."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639 Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-10T05:30:55.254Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/136f8e94-a09a-48c4-bea9-e8b21d3fd91f?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.6.11/lib/helpers/steps_helper.php#L1028"
},
{
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.6.11/lib/helpers/steps_helper.php#L1281"
},
{
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.6.11/lib/models/booking_model.php#L842"
},
{
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.6.11/lib/helpers/steps_helper.php#L677"
},
{
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.6.11/lib/helpers/steps_helper.php#L2350"
},
{
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.6.11/lib/controllers/steps_controller.php#L17"
},
{
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.6.11/lib/controllers/steps_controller.php#L341"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-14T17:30:15.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-10-09T17:18:27.000Z",
"value": "Disclosed"
}
],
"title": "Appointment Booking Plugin \u003c= 5.7.2 - Insecure Direct Object Reference to Authenticated (Subscriber+) Unauthorized Booking Creation and Sensitive Information Disclosure via \u0027params[presets][order_item_id]\u0027 Parameter"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-91050",
"datePublished": "2026-10-10T05:30:55.254Z",
"dateReserved": "2026-09-14T17:15:11.459Z",
"dateUpdated": "2026-10-11T16:55:18.699Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-17538 (GCVE-0-2026-17538)
Vulnerability from cvelistv5 – Published: 2026-10-07 23:27 – Updated: 2026-10-10 02:50
VLAI
EPSS
VEX
Title
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress <= 5.6.9 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Customer PII Modification
Summary
The LatePoint - Appointment Booking & Reservation plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 5.6.9. This is due to the process_step_customer() function using is_user_logged_in() as the sole gate before merging POSTed customer data into an existing LatePoint customer, without any ownership checks. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify the personal information (first name, last name, email, phone, notes) of arbitrary LatePoint customers, and, when the contact_merge setting is 'phone', to overwrite the victim's email address and take over the account via a password reset.
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-10 02:50 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| latepoint | Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress |
Affected:
0 , ≤ 5.6.9
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-17538",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-10T02:50:40.425401Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-10T02:50:49.302Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Appointment Booking Plugin \u2013 LatePoint | Calendar \u0026 Scheduling for WordPress",
"vendor": "latepoint",
"versions": [
{
"lessThanOrEqual": "5.6.9",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "owlmind"
}
],
"descriptions": [
{
"lang": "en",
"value": "The LatePoint - Appointment Booking \u0026 Reservation plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 5.6.9. This is due to the process_step_customer() function using is_user_logged_in() as the sole gate before merging POSTed customer data into an existing LatePoint customer, without any ownership checks. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify the personal information (first name, last name, email, phone, notes) of arbitrary LatePoint customers, and, when the contact_merge setting is \u0027phone\u0027, to overwrite the victim\u0027s email address and take over the account via a password reset."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639 Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T23:27:12.424Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/83cdc51f-b5e1-42b9-972a-7e781f97b43e?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3631493/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-06-22T00:00:00.000Z",
"value": "Discovered"
},
{
"lang": "en",
"time": "2026-07-27T09:51:30.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-10-07T11:12:20.000Z",
"value": "Disclosed"
}
],
"title": "Appointment Booking Plugin \u2013 LatePoint | Calendar \u0026 Scheduling for WordPress \u003c= 5.6.9 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Customer PII Modification"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-17538",
"datePublished": "2026-10-07T23:27:12.424Z",
"dateReserved": "2026-07-27T09:35:22.512Z",
"dateUpdated": "2026-10-10T02:50:49.302Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-94432 (GCVE-0-2026-94432)
Vulnerability from cvelistv5 – Published: 2026-10-02 07:39 – Updated: 2026-10-03 15:42
VLAI
EPSS
VEX
Title
Appointment Booking Plugin <= 5.7.1 - Insecure Direct Object Reference to Unauthenticated Unauthorized Transaction Intent Creation/Modification and Invoice Enumeration via 'invoice_id' Parameter
Summary
The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 5.7.1 via the OsPaypalConnectController::create_order_for_transaction() action registered as a public (unauthenticated) route through wp_ajax_nopriv_latepoint_route_call. The handler loads an OsInvoiceModel by a sequential integer 'invoice_id' with no access-key/UUID or ownership check (the sibling Stripe and Razorpay handlers require a 128-bit access-key UUID via OsInvoicesHelper::get_invoice_by_key), and then calls OsTransactionIntentHelper::create_or_update_transaction_intent() which persists a transaction intent tied to the target invoice's customer_id, order_id and charge_amount and regenerates its intent_key before the PayPal-configured guard is reached. This makes it possible for unauthenticated attackers to enumerate invoices belonging to arbitrary customers, create unauthorized transaction-intent rows linked to another customer's data, and overwrite the intent_key of any in-flight NEW-status transaction intent — invalidating the intent_key that legitimate Stripe/Razorpay flows are waiting on and breaking payment webhooks for those customers.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-03 15:29 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
7 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| latepoint | Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress |
Affected:
0 , ≤ 5.7.1
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-94432",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-03T15:29:06.542489Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-03T15:42:48.459Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Appointment Booking Plugin \u2013 LatePoint | Calendar \u0026 Scheduling for WordPress",
"vendor": "latepoint",
"versions": [
{
"lessThanOrEqual": "5.7.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Niv Kochan"
},
{
"lang": "en",
"type": "finder",
"value": "Matan Bachar"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Appointment Booking Plugin \u2013 LatePoint | Calendar \u0026 Scheduling for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 5.7.1 via the OsPaypalConnectController::create_order_for_transaction() action registered as a public (unauthenticated) route through wp_ajax_nopriv_latepoint_route_call. The handler loads an OsInvoiceModel by a sequential integer \u0027invoice_id\u0027 with no access-key/UUID or ownership check (the sibling Stripe and Razorpay handlers require a 128-bit access-key UUID via OsInvoicesHelper::get_invoice_by_key), and then calls OsTransactionIntentHelper::create_or_update_transaction_intent() which persists a transaction intent tied to the target invoice\u0027s customer_id, order_id and charge_amount and regenerates its intent_key before the PayPal-configured guard is reached. This makes it possible for unauthenticated attackers to enumerate invoices belonging to arbitrary customers, create unauthorized transaction-intent rows linked to another customer\u0027s data, and overwrite the intent_key of any in-flight NEW-status transaction intent \u2014 invalidating the intent_key that legitimate Stripe/Razorpay flows are waiting on and breaking payment webhooks for those customers."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639 Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-02T07:39:29.009Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e101bc4e-1c5d-4f30-a1eb-617b0db92723?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.0/lib/controllers/paypal_connect_controller.php#L31"
},
{
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.0/lib/controllers/paypal_connect_controller.php#L20"
},
{
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.0/lib/helpers/transaction_intent_helper.php#L85"
},
{
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.0/latepoint.php#L1072"
},
{
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.0/lib/controllers/controller.php#L57"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3709058%40latepoint\u0026new=3709058%40latepoint"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-21T16:21:24.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-10-01T19:14:41.000Z",
"value": "Disclosed"
}
],
"title": "Appointment Booking Plugin \u003c= 5.7.1 - Insecure Direct Object Reference to Unauthenticated Unauthorized Transaction Intent Creation/Modification and Invoice Enumeration via \u0027invoice_id\u0027 Parameter"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-94432",
"datePublished": "2026-10-02T07:39:29.009Z",
"dateReserved": "2026-09-21T16:06:17.998Z",
"dateUpdated": "2026-10-03T15:42:48.459Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-92966 (GCVE-0-2026-92966)
Vulnerability from cvelistv5 – Published: 2026-10-01 04:27 – Updated: 2026-10-01 14:17
VLAI
EPSS
VEX
Title
Appointment Booking Plugin <= 5.7.0 - Unauthenticated Arbitrary Shortcode Execution via First/Last Name Field
Summary
The The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.7.0. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. The payload is planted during the unauthenticated booking flow and triggered when the Customer Cabinet block rendered by render_customer_dashboard() outputs the stored name into the content stream, where WordPress core's do_shortcode filter at priority 11 re-parses and executes it.
Severity
9.1 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-01 14:17 UTC
CWE
- CWE-94 - Improper Control of Generation of Code ('Code Injection')
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| latepoint | Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress |
Affected:
0 , ≤ 5.7.0
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-92966",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-01T14:17:22.790468Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-01T14:17:31.516Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Appointment Booking Plugin \u2013 LatePoint | Calendar \u0026 Scheduling for WordPress",
"vendor": "latepoint",
"versions": [
{
"lessThanOrEqual": "5.7.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "hashiramasenju333"
}
],
"descriptions": [
{
"lang": "en",
"value": "The The Appointment Booking Plugin \u2013 LatePoint | Calendar \u0026 Scheduling for WordPress plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.7.0. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. The payload is planted during the unauthenticated booking flow and triggered when the Customer Cabinet block rendered by render_customer_dashboard() outputs the stored name into the content stream, where WordPress core\u0027s do_shortcode filter at priority 11 re-parses and executes it."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-01T04:27:34.115Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c9a030c0-6129-40b0-81da-4c420929d198?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.0/lib/helpers/blocks_helper.php#L234"
},
{
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.0/lib/views/customer_cabinet/dashboard.php#L19"
},
{
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.0/lib/models/customer_model.php#L386"
},
{
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.1/lib/helpers/blocks_helper.php"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-17T13:25:38.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-09-30T15:46:49.000Z",
"value": "Disclosed"
}
],
"title": "Appointment Booking Plugin \u003c= 5.7.0 - Unauthenticated Arbitrary Shortcode Execution via First/Last Name Field"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-92966",
"datePublished": "2026-10-01T04:27:34.115Z",
"dateReserved": "2026-09-17T13:10:34.409Z",
"dateUpdated": "2026-10-01T14:17:31.516Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-13471 (GCVE-0-2026-13471)
Vulnerability from cvelistv5 – Published: 2026-09-18 07:40 – Updated: 2026-09-18 19:58
VLAI
EPSS
VEX
Title
LatePoint <= 5.6.3 - Authenticated (Custom+) Insecure Direct Object Reference to Arbitrary Booking Deletion and Customer/Booking Data Disclosure via Abilities REST API (list-bookings, list-customers, delete-booking)
Summary
The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.6.3 via the LatePointAbilityDeleteBooking::execute due to missing validation on a user controlled key. This makes it possible for attackers, with LatePoint Agent-level access and above, to read bookings and customer PII (full name, email, phone, and notes) assigned to other LatePoint agents, and delete arbitrary bookings by supplying any booking ID. This vulnerability is only exploitable when an administrator has enabled the Abilities API toggles (latepoint_abilities_api, latepoint_abilities_api_delete, and/or latepoint_abilities_api_edit) in the plugin settings.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-18 19:57 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
14 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| latepoint | Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress |
Affected:
0 , ≤ 5.6.3
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-13471",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-18T19:57:24.068567Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T19:58:00.084Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Appointment Booking Plugin \u2013 LatePoint | Calendar \u0026 Scheduling for WordPress",
"vendor": "latepoint",
"versions": [
{
"lessThanOrEqual": "5.6.3",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "skyv3il"
},
{
"lang": "en",
"type": "finder",
"value": "Chirita Catalin-Andrei (CC99IE)"
},
{
"lang": "en",
"type": "finder",
"value": "AmonRa"
},
{
"lang": "en",
"type": "finder",
"value": "MrProperCTF"
}
],
"descriptions": [
{
"lang": "en",
"value": "The LatePoint \u2013 Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.6.3 via the LatePointAbilityDeleteBooking::execute due to missing validation on a user controlled key. This makes it possible for attackers, with LatePoint Agent-level access and above, to read bookings and customer PII (full name, email, phone, and notes) assigned to other LatePoint agents, and delete arbitrary bookings by supplying any booking ID. This vulnerability is only exploitable when an administrator has enabled the Abilities API toggles (latepoint_abilities_api, latepoint_abilities_api_delete, and/or latepoint_abilities_api_edit) in the plugin settings."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639 Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T07:40:00.105Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/448df3b0-32a7-4097-a37d-07e253993496?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.6.3/lib/abilities/bookings/delete-booking.php#L47"
},
{
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.6.3/lib/abilities/bookings/list-bookings.php#L50"
},
{
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.6.3/lib/abilities/customers/list-customers.php#L78"
},
{
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.6.3/lib/abilities/bookings/abstract-booking-ability.php#L34"
},
{
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.6.3/lib/abilities/abstract-ability.php#L55"
},
{
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.6.3/lib/abilities/class-latepoint-abilities.php#L77"
},
{
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.4.2/lib/abilities/bookings/delete-booking.php#L47"
},
{
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.4.2/lib/abilities/bookings/list-bookings.php#L50"
},
{
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.4.2/lib/abilities/customers/list-customers.php#L78"
},
{
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.4.2/lib/abilities/bookings/abstract-booking-ability.php#L34"
},
{
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.4.2/lib/abilities/abstract-ability.php#L55"
},
{
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.4.2/lib/abilities/class-latepoint-abilities.php#L77"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026new=3590914%40latepoint\u0026old=3584059%40latepoint"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-06-26T21:28:56.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-09-17T19:13:36.000Z",
"value": "Disclosed"
}
],
"title": "LatePoint \u003c= 5.6.3 - Authenticated (Custom+) Insecure Direct Object Reference to Arbitrary Booking Deletion and Customer/Booking Data Disclosure via Abilities REST API (list-bookings, list-customers, delete-booking)"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-13471",
"datePublished": "2026-09-18T07:40:00.105Z",
"dateReserved": "2026-06-26T21:13:39.703Z",
"dateUpdated": "2026-09-18T19:58:00.084Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-18441 (GCVE-0-2026-18441)
Vulnerability from cvelistv5 – Published: 2026-09-17 23:27 – Updated: 2026-09-19 14:21
VLAI
EPSS
VEX
Title
LatePoint - Appointment Booking & Scheduling <= 5.6.9 - Unauthenticated Insecure Direct Object Reference to Sensitive Information Disclosure via 'customer[id]' Parameter
Summary
The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.6.9 via the set_customer_object due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to enumerate arbitrary customer records and disclose personally identifiable information - including first name, last name, email address, and phone number - by iterating the customer[id] parameter. This issue is exploitable only when the site is configured with customer authentication disabled (guest checkout enabled).
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-19 13:19 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| latepoint | Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress |
Affected:
0 , ≤ 5.6.9
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-18441",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-19T13:19:23.665831Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-19T14:21:52.663Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Appointment Booking Plugin \u2013 LatePoint | Calendar \u0026 Scheduling for WordPress",
"vendor": "latepoint",
"versions": [
{
"lessThanOrEqual": "5.6.9",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Sorra"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Appointment Booking Plugin \u2013 LatePoint | Calendar \u0026 Scheduling for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.6.9 via the set_customer_object due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to enumerate arbitrary customer records and disclose personally identifiable information - including first name, last name, email address, and phone number - by iterating the customer[id] parameter. This issue is exploitable only when the site is configured with customer authentication disabled (guest checkout enabled)."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639 Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-17T23:27:10.903Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d80ed885-43f8-43a4-bc61-e9ef92e3207e?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.6.9/lib/helpers/steps_helper.php#L1184"
},
{
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.6.9/lib/models/model.php#L574"
},
{
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.6.9/lib/controllers/steps_controller.php#L341"
},
{
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.6.9/latepoint.php#L1006"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-06-25T00:00:00.000Z",
"value": "Discovered"
},
{
"lang": "en",
"time": "2026-07-30T21:03:15.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-09-17T10:58:18.000Z",
"value": "Disclosed"
}
],
"title": "LatePoint - Appointment Booking \u0026 Scheduling \u003c= 5.6.9 - Unauthenticated Insecure Direct Object Reference to Sensitive Information Disclosure via \u0027customer[id]\u0027 Parameter"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-18441",
"datePublished": "2026-09-17T23:27:10.903Z",
"dateReserved": "2026-07-30T20:33:41.814Z",
"dateUpdated": "2026-09-19T14:21:52.663Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-5391 (GCVE-0-2026-5391)
Vulnerability from cvelistv5 – Published: 2026-08-06 11:29 – Updated: 2026-08-06 15:37
VLAI
EPSS
VEX
Title
LatePoint <= 5.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Summary
The LatePoint plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'btn_wrapper_classes' attribute of the 'latepoint_resources' shortcode in all versions up to, and including, 5.3.2. This is due to insufficient input sanitization and output escaping in the 'locations' branch of the 'shortcode_latepoint_resources' function. This makes it possible for authenticated attackers, with contributor level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Severity
6.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-06 15:26 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| latepoint | Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress |
Affected:
0 , ≤ 5.3.2
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-5391",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-06T15:26:23.983373Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-06T15:37:10.544Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Appointment Booking Plugin \u2013 LatePoint | Calendar \u0026 Scheduling for WordPress",
"vendor": "latepoint",
"versions": [
{
"lessThanOrEqual": "5.3.2",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "alex_henry20"
}
],
"descriptions": [
{
"lang": "en",
"value": "The LatePoint plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u0027btn_wrapper_classes\u0027 attribute of the \u0027latepoint_resources\u0027 shortcode in all versions up to, and including, 5.3.2. This is due to insufficient input sanitization and output escaping in the \u0027locations\u0027 branch of the \u0027shortcode_latepoint_resources\u0027 function. This makes it possible for authenticated attackers, with contributor level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-06T11:29:19.969Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/25ea860e-c4f8-4660-a8cb-aafc4d02bb19?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3505127/latepoint/trunk/lib/helpers/shortcodes_helper.php"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-03-20T00:00:00.000Z",
"value": "Discovered"
},
{
"lang": "en",
"time": "2026-04-01T23:25:08.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-08-05T22:11:54.000Z",
"value": "Disclosed"
}
],
"title": "LatePoint \u003c= 5.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-5391",
"datePublished": "2026-08-06T11:29:19.969Z",
"dateReserved": "2026-04-01T23:08:21.183Z",
"dateUpdated": "2026-08-06T15:37:10.544Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-57714 (GCVE-0-2026-57714)
Vulnerability from cvelistv5 – Published: 2026-07-13 08:41 – Updated: 2026-07-13 13:30
VLAI
EPSS
VEX
Title
WordPress LatePoint plugin <= 5.6.3 - SQL Injection vulnerability
Summary
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LatePoint LatePoint latepoint allows Blind SQL Injection.This issue affects LatePoint: from n/a through <= 5.6.3.
Severity
9.3 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-13 13:30 UTC
CWE
- CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://patchstack.com/database/Wordpress/Plugin/… | vdb-entry |
Impacted products
Date Public
2026-07-13 10:37
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-57714",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-13T13:30:47.245873Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-13T13:30:52.769Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"packageName": "latepoint",
"product": "LatePoint",
"vendor": "LatePoint",
"versions": [
{
"changes": [
{
"at": "5.6.4",
"status": "unaffected"
}
],
"lessThanOrEqual": "5.6.3",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "daroo | Patchstack Bug Bounty Program"
}
],
"datePublic": "2026-07-13T10:37:38.097Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027) vulnerability in LatePoint LatePoint latepoint allows Blind SQL Injection.\u003cp\u003eThis issue affects LatePoint: from n/a through \u003c= 5.6.3.\u003c/p\u003e"
}
],
"value": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027) vulnerability in LatePoint LatePoint latepoint allows Blind SQL Injection.This issue affects LatePoint: from n/a through \u003c= 5.6.3."
}
],
"impacts": [
{
"capecId": "CAPEC-7",
"descriptions": [
{
"lang": "en",
"value": "Blind SQL Injection"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-13T08:41:24.759Z",
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack"
},
"references": [
{
"tags": [
"vdb-entry"
],
"url": "https://patchstack.com/database/Wordpress/Plugin/latepoint/vulnerability/wordpress-latepoint-plugin-5-6-3-sql-injection-vulnerability?_s_id=cve"
}
],
"title": "WordPress LatePoint plugin \u003c= 5.6.3 - SQL Injection vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"assignerShortName": "Patchstack",
"cveId": "CVE-2026-57714",
"datePublished": "2026-07-13T08:41:24.759Z",
"dateReserved": "2026-06-25T08:04:04.790Z",
"dateUpdated": "2026-07-13T13:30:52.769Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}