What is the CVSS score of CVE-2026-12657?

CVE-2026-12657 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.7%.

LatePoint Booking Plugin CVE-2026-12657

EUVD-2026-41261 MEDIUM

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-07-02 Wordfence

GHSA-p2v5-84j7-pc37

WordPress Authentication Bypass Latepoint Latepoint Calendar Booking Plugin For Appointments And Events Wordpress Plugin

5.3

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

5.3 MEDIUM

Unauthenticated network exploitation with no complexity barriers; only integrity is impacted through unauthorized booking creation, with no confidentiality or availability consequence.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 02, 2026 - 10:20 vuln.today

CVE Published

Jul 02, 2026 - 08:33 cve.org

MEDIUM 5.3

DescriptionCVE.org

The LatePoint - Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.6.2 via the 'service_id' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to create approved bookings against services explicitly restricted to admins and agents, consuming restricted appointment capacity and triggering unauthorized bookings for admin/agent-only services. The bypass works via both the params[booking][service_id] parameter in steps__load_step and the presets[selected_service] parameter in steps__start, both of which are publicly accessible without authentication.

AnalysisAI

Insecure Direct Object Reference in LatePoint Calendar Booking Plugin for WordPress (all versions ≤ 5.6.2) enables unauthenticated attackers to create approved bookings against services explicitly restricted to administrators and agents. The bypass operates through two publicly accessible booking step endpoints that accept a user-controlled service identifier without validating the requester's authorization to book that service. No public exploit code or CISA KEV listing has been identified, but the CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms trivially exploitable, zero-barrier network access against default plugin configurations that utilize service-level access restrictions.

Technical ContextAI

The vulnerability is classified as CWE-639 (Authorization Bypass Through User-Controlled Key), a subclass of broken access control where the application trusts a user-supplied identifier to determine object access without verifying the requester's entitlement. The affected plugin (CPE: cpe:2.3:a:latepoint:latepoint_-_calendar_booking_plugin_for_appointments_and_events:*:*:*:*:*:*:*:*) exposes two booking workflow endpoints - steps__load_step and steps__start - that accept service identifiers via params[booking][service_id] and presets[selected_service] respectively. Both parameters are processed in steps_helper.php (lines 1202, 1618, 1710) and steps_controller.php (lines 244, 341) without checking whether the authenticated (or unauthenticated) caller is permitted to interact with the specified service. WordPress plugin architecture means these AJAX-accessible endpoints are reachable by any visitor without a WordPress session, compounding the missing authorization check.

RemediationAI

Update the LatePoint plugin to a version above 5.6.2 as soon as a patched release is confirmed available. A patch changeset has been committed to the WordPress plugin repository (https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3584059%40latepoint&new=3584059%40latepoint), but the exact patched release version number is not independently confirmed in available data - verify the current patched version against the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/09588c2a-1631-4924-8277-d47f096493c5 or the WordPress plugin changelog before updating. As an interim compensating control, web application firewall rules can be configured to block or rate-limit POST requests to the steps__load_step and steps__start endpoints, specifically filtering or rejecting arbitrary values in the params[booking][service_id] and presets[selected_service] parameters - note this may disrupt legitimate booking flows and should be tested in staging first. Alternatively, temporarily setting all LatePoint services to unrestricted visibility removes the exploitable condition, though at the cost of eliminating access control functionality until the patch is applied.