LatePoint Plugin CVE-2026-11398

Exploitation requires the LatePoint plugin to be configured with guest bookings enabled - specifically, the internal function is_customer_auth_disabled() must return true, which is a deliberate operator-configured setting permitting unauthenticated users to complete bookings without logging in. This is not confirmed to be the default installation state; it represents a specific deployment mode. The attacker must additionally know or successfully enumerate a valid email address belonging to an existing customer record in the target site's LatePoint database. Exploitation is bounded by three factors: (1) the guest-booking configuration must be active, (2) a valid target customer email must be known or discoverable, and (3) impact is strictly limited to overwriting PII fields (first name, last name, phone number, notes) - no password exposure, no session hijacking, no code execution, and no privilege escalation are possible through this vector.

The vendor-assigned CVSS 3.1 score of 5.3 Medium (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) is consistent with the vulnerability's actual scope: integrity-only impact limited to PII field modification, with no confidentiality exposure and no availability impact. The zero-authentication, network-exploitable nature raises surface concern, but the mandatory prerequisite - guest bookings must be explicitly enabled - substantially narrows the exposed population to sites where an operator made a deliberate configuration choice. No EPSS score was provided in the source data, precluding probability-of-exploitation comparison. The absence of a CISA KEV listing and no confirmed public POC together suggest no known opportunistic mass exploitation. The highest-risk scenario is corruption of admin-linked customer records for social engineering purposes, not account takeover or code execution. Overall, this is a genuine integrity vulnerability that warrants prompt patching but is not a critical emergency for the majority of WordPress deployments.

An attacker targeting a WordPress site with LatePoint's guest booking feature enabled enumerates a valid customer email address - obtainable via booking confirmation emails, contact forms, or guessing common patterns - then submits the public-facing LatePoint booking form with that email and arbitrary values in the name, phone, and notes fields. The plugin matches the email to the existing customer record and updates the PII without any authorization check, silently overwriting the legitimate customer's data. If the targeted email is associated with an administrator's customer profile, the corrupted record could be leveraged to misdirect communications or undermine trust with that account holder.