EUVD-2026-41261
GHSA-p2v5-84j7-pc37
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify WordPress site with LatePoint plugin installed
-
DeliveryEnumerate restricted service IDs via sequential presets[selected_service] values
-
ExploitSubmit crafted POST to public steps__start or steps__load_step endpoint
-
ExecutionPlugin processes booking without authorization check
-
PersistApproved booking created for admin/agent-only service
-
ImpactRestricted appointment capacity consumed and unauthorized booking notifications triggered
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Object-level authorization, IDOR prevention
|
| Exploitation Conditions | No authentication is required - CVSS PR:N confirms the vulnerable endpoints are accessible to any unauthenticated visitor. The exploitable condition is that the LatePoint plugin must have at least one service configured with admin/agent-only access restrictions; sites using LatePoint solely for unrestricted public-facing services would not experience meaningful impact from this bypass. The two specific vulnerable parameters are params[booking][service_id] in the steps__load_step action and presets[selected_service] in the steps__start action, both processed without authorization validation. Exploitation is bounded in impact: attackers can only create bookings and consume appointment capacity - there is no path to code execution, data exfiltration, credential theft, or privilege escalation. The attacker must also be able to enumerate or guess valid service IDs (typically small integers), which is a minor but non-zero obstacle. |
| Impact | The CVSS 5.3 Medium score reflects the constrained integrity-only impact (C:N/I:L/A:N) despite a fully unauthenticated, network-accessible, zero-complexity attack path. The most significant risk signal is the AV:N/AC:L/PR:N/UI:N combination - there is no barrier to exploitation whatsoever beyond knowing a restricted service ID, which is easily enumerated by cycling integer values. EPSS data is absent from available intelligence, preventing probabilistic exploitation likelihood assessment. KEV status is negative and no POC has been identified, suggesting exploitation has not yet been observed at scale. Real-world business impact is higher than CVSS implies for affected deployments: unauthorized booking creation can exhaust restricted appointment capacity, generate fraudulent booking confirmations, and trigger administrative workflows for premium or private services. This divergence between CVSS score and business impact is a known limitation when integrity impact is restricted to I:L despite material operational consequences. Defenders should prioritize patching on sites actively using LatePoint's service-level access restriction feature. |
| Exploit ScenarioDerived | An unauthenticated attacker sends sequential POST requests to the publicly accessible steps__start endpoint, incrementing the presets[selected_service] integer parameter to enumerate service IDs until responses indicate a restricted admin/agent-only service. The attacker then completes the booking workflow through steps__load_step using the identified restricted service_id, causing the plugin to create an approved booking and consume capacity on the restricted service without any WordPress login or plugin account. No public proof-of-concept code has been identified, but the attack requires only basic HTTP tooling and service ID enumeration. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 02, 2026
Insecure Direct Object Reference in LatePoint Calendar Booking Plugin for WordPress (all versions ≤ 5.6.2) enables unauthenticated attackers to create approved bookings against services explicitly restricted to administrators and agents. The bypass operates through two publicly accessible booking step endpoints that accept a user-controlled service identifier without validating the requester's authorization to book that service. No public exploit code or CISA KEV listing has been identified, but the CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms trivially exploitable, zero-barrier network access against default plugin configurations that utilize service-level access restrictions.
RemediationAI
Update the LatePoint plugin to a version above 5.6.2 as soon as a patched release is confirmed available. A patch changeset has been committed to the WordPress plugin repository (https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3584059%40latepoint&new=3584059%40latepoint), but the exact patched release version number is not independently confirmed in available data - verify the current patched version against the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/09588c2a-1631-4924-8277-d47f096493c5 or the WordPress plugin changelog before updating. As an interim compensating control, web application firewall rules can be configured to block or rate-limit POST requests to the steps__load_step and steps__start endpoints, specifically filtering or rejecting arbitrary values in the params[booking][service_id] and presets[selected_service] parameters - note this may disrupt legitimate booking flows and should be tested in staging first. Alternatively, temporarily setting all LatePoint services to unrestricted visibility removes the exploitable condition, though at the cost of eliminating access control functionality until the patch is applied.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is classified as CWE-639 (Authorization Bypass Through User-Controlled Key), a subclass of broken access control where the application trusts a user-supplied identifier to determine object access without verifying the requester's entitlement. The affected plugin (CPE: cpe:2.3:a:latepoint:latepoint_-_calendar_booking_plugin_for_appointments_and_events:*:*:*:*:*:*:*:*) exposes two booking workflow endpoints - steps__load_step and steps__start - that accept service identifiers via params[booking][service_id] and presets[selected_service] respectively. Both parameters are processed in steps_helper.php (lines 1202, 1618, 1710) and steps_controller.php (lines 244, 341) without checking whether the authenticated (or unauthenticated) caller is permitted to interact with the specified service. WordPress plugin architecture means these AJAX-accessible endpoints are reachable by any visitor without a WordPress session, compounding the missing authorization check.
Know when Latepoint gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Unauthenticated network exploitation with no complexity barriers; only integrity is impacted through unauthorized booking creation, with no confidentiality or availability consequence.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
DescriptionCVE.org
The LatePoint - Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.6.2 via the 'service_id' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to create approved bookings against services explicitly restricted to admins and agents, consuming restricted appointment capacity and triggering unauthorized bookings for admin/agent-only services. The bypass works via both the params[booking][service_id] parameter in steps__load_step and the presets[selected_service] parameter in steps__start, both of which are publicly accessible without authentication.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
The LatePoint plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 5.0.12. Rate
The LatePoint plugin for WordPress is vulnerable to Arbitrary User Password Change via SQL Injection in versions up to,
The LatePoint Plugin plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a
Price tampering in the LatePoint WordPress booking plugin before 5.7.5 lets a remote unauthenticated visitor manipulate
Blind SQL injection in the LatePoint WordPress appointment-booking plugin (versions up to and including 5.6.3) lets remo
LatePoint WordPress plugin through 5.7.4 allows unauthenticated remote attackers who know a target customer's registered
Unauthenticated arbitrary shortcode execution in LatePoint (Appointment Booking Plugin - Calendar & Scheduling for WordP
Privilege escalation in the LatePoint appointment booking plugin for WordPress (all versions up to and including 5.7.3)
Privilege escalation in the LatePoint booking plugin for WordPress (versions ≤ 5.4.1) lets an authenticated user holding
Privilege escalation to Administrator in the LatePoint booking plugin for WordPress (versions up to and including 5.6.3)
Cross-Site Request Forgery (CSRF) vulnerability in Latepoint LatePoint allows Cross Site Request Forgery.9.91. Rated hig
Privilege escalation in the LatePoint Calendar Booking plugin for WordPress (versions up to and including 5.5.1) allows
Exploit-DB