What is the CVSS score of CVE-2026-11398?

CVE-2026-11398 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.3%.

LatePoint Plugin CVE-2026-11398

EUVD-2026-41524 MEDIUM

Missing Authorization (CWE-862)

2026-07-03 Wordfence

GHSA-w64h-p64p-r649

WordPress Authentication Bypass Latepoint Latepoint Calendar Booking Plugin For Appointments And Events Wordpress Plugin

5.3

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

5.3 MEDIUM

Network-accessible booking form requires no authentication under guest-booking config; only PII integrity is affected with no confidentiality or availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 03, 2026 - 09:17 vuln.today

CVE Published

Jul 03, 2026 - 07:53 cve.org

MEDIUM 5.3

DescriptionCVE.org

The LatePoint - Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.6.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to modify the personally identifiable information (first name, last name, phone number, and notes) of any existing customer record, including those linked to administrator accounts, by submitting the booking form with a known customer's email address. Exploitation requires the plugin to be configured with guest bookings enabled (is_customer_auth_disabled() returning true), which is necessary for the vulnerable unauthenticated code path in process_step_customer() to be reached.

AnalysisAI

Authorization bypass in the LatePoint Calendar Booking Plugin for WordPress (all versions through 5.6.1) permits unauthenticated attackers to overwrite customer PII - first name, last name, phone number, and notes - on any existing customer record, including those associated with administrator accounts, by submitting the public booking form with a known or guessed target email address. The attack is gated by a specific non-default plugin configuration (guest bookings enabled), meaningfully narrowing the realistic exposure surface. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.

Technical ContextAI

The LatePoint plugin (CPE: cpe:2.3:a:latepoint:latepoint_-_calendar_booking_plugin_for_appointments_and_events:*:*:*:*:*:*:*:*) implements a multi-step booking workflow in which customer data is processed through process_step_customer() in lib/helpers/steps_helper.php (lines 1892, 1953, 1980) and dispatched via lib/controllers/steps_controller.php (line 22). CWE-862 (Missing Authorization) is the root cause: when the helper function is_customer_auth_disabled() returns true - indicating guest bookings are permitted - the code path handling customer record updates does not verify that the submitting user owns or is authorized to modify the matched customer record. Email address is used as the lookup key, so any actor who knows a registered customer's email can submit the booking form to overwrite that record's PII fields. Both the 5.3.2 and 5.6.1 trac tags confirm the same vulnerable code paths exist across the version range, and a fix changeset (revision 3572632) has been committed to the plugin repository.

RemediationAI

Update the LatePoint plugin to a version beyond 5.6.1 as soon as an updated release is published to the WordPress plugin directory; a fix has been committed to the plugin repository as changeset revision 3572632 (https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3572632%40latepoint&new=3572632%40latepoint&sfp_email=&sfph_mail=), though the exact released patched version number has not been independently confirmed from available data - verify against the WordPress.org plugin page. The single most effective immediate compensating control is to disable guest bookings in the LatePoint plugin settings, which prevents is_customer_auth_disabled() from returning true and eliminates the unauthenticated vulnerable code path entirely; the trade-off is that customers will be required to register or log in before booking, which may reduce conversion rates. No other granular workaround is available within the plugin itself, as the flaw is in the authorization check absent from the guest path. Monitor the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/e4dcedcc-2878-47b2-99f0-ecba2cc33b69?source=cve for confirmed fix version.