Appointment Booking Plugin CVE-2026-105196

Exploitation requires (1) the optional 'AI Abilities API' feature of the Appointment Booking Plugin (LatePoint) to be enabled, which is the specific configuration precondition, and (2) the attacker to hold a valid, authenticated LatePoint Agent role account. Given those, the missing per-record authorization check on several Abilities API actions lets the agent read and modify other agents' profile data and read other agents' bookings and customer details. Limiting factors: the Abilities API feature is not a universal default, the attacker must already possess agent-level staff credentials, and impact is confined to cross-agent data (profiles, bookings, customer PII) with no reported path to full site compromise or availability loss.

This is a low-to-moderate real-world risk, not a top priority. The input CVSS of 3.3 (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N) reflects a horizontal privilege escalation (IDOR, CWE-639) rather than a critical RCE: impact is limited to Low confidentiality and Low integrity, with no availability impact and no scope change. No EPSS score, KEV listing, or POC was provided, so exploitation status is 'no public exploit identified at time of analysis'. One signal conflict is worth flagging: the input vector sets PR:H, but the description says the attacker only needs the 'LatePoint Agent' role - a restricted staff role, which is more consistent with PR:L (low-privilege authenticated user) than PR:H; this understates the practical ease of abuse once an agent account exists. Conversely, AC:H likely encodes the dependency on the optional 'AI Abilities API' feature being enabled, which is a genuine limiting condition. Net: a legitimate access-control bug exposing cross-agent PII and allowing profile tampering, but gated behind both a valid agent account and a non-default feature, so it is a targeted/insider-leaning issue rather than a mass-exploitation threat.

A rogue or compromised LatePoint Agent (staff) account calls the AI Abilities API actions and, because per-record authorization is not enforced, manipulates record identifiers to read and alter other agents' profiles and to pull other agents' bookings along with associated customer details. No public exploit code was identified, and exploitation requires a valid agent account plus the Abilities API feature enabled, so the practical risk is primarily malicious-insider or account-takeover driven.