LatePoint CVE-2026-111602

Exploitation is strictly gated on a specific non-default configuration: the LatePoint plugin must have 'Field used for authentication' set to 'Disable ability to login' (guest checkout mode) - sites using the default login-based authentication are NOT affected. When that condition is met, no authentication, user interaction, or special privileges are required; an unauthenticated remote attacker can reach the steps__load_step AJAX endpoint directly. The primary practical limiter beyond the config dependency is the need to enumerate customer[uuid] prefixes (reflected in CVSS AC:H), which requires many automated requests and may be slowed or detected by rate limiting or WAFs, but does not prevent bulk extraction on an unprotected site.

This is a genuine but conditional and relatively low-urgency issue - the signals are internally consistent rather than conflicting. The CVSS 3.1 base score of 3.7 (LOW) is driven by AV:N/PR:N/UI:N (remotely reachable by unauthenticated attackers with no user interaction) but tempered by AC:H and C:L/I:N/A:N (only partial confidentiality impact, no integrity or availability effect). The AC:H rating correctly reflects two real barriers: the vulnerability is ONLY present when the non-default 'Field used for authentication' = 'Disable ability to login' (guest checkout) setting is active, and exploitation requires brute-force enumeration of uuid prefixes rather than a single deterministic request. No EPSS score, KEV listing, or POC indicator was provided in the input; per precision rules this is treated as 'no public exploit identified at time of analysis' and the absence of EPSS/KEV is not itself a red flag for a freshly disclosed low-severity plugin bug. The real-world risk is best characterized as a bulk-PII-harvesting data-exposure flaw affecting a specific subset of deployments (guest-checkout configured sites), not a critical RCE - but note that the practical impact (name, email, phone, and notes of EVERY customer) is more consequential for privacy/compliance (GDPR) than the LOW CVSS suggests, so defenders running guest checkout should prioritize it above its numeric score. This is a patch-in-normal-cycle item for most, but elevated for guest-checkout sites handling sensitive appointment data.

An attacker identifies a WordPress site running LatePoint in guest-checkout mode and sends repeated unauthenticated requests to the steps__load_step AJAX endpoint, varying the customer[uuid] prefix to enumerate valid records. Because the endpoint reflects matching customer data, the attacker systematically walks the uuid space and scrapes the first name, last name, email, phone number, and notes of every customer in the database. No public exploit code was identified in the provided data, though the technique is simple to script given the disclosed endpoint and parameter.