Latepoint CVE-2026-32533

While CVSS and EPSS scores are not available for this CVE, the practical risk is moderate to high based on multiple corroborating signals. The vulnerability has confirmed proof-of-concept details documented by Patchstack, indicating active discoverability and likely exploitability. The attack vector is network-based and requires low or no privileges, and complexity appears low given the nature of IDOR vulnerabilities. The technical impact is significant as it enables unauthorized data access and modification. However, the real-world risk depends on deployment scope: LatePoint is a WordPress plugin, so exposure is limited to organizations using this specific plugin version. The vulnerability affects a wide version range (up to 5.2.6), suggesting it may have existed for some time. The absence of KEV listing does not reduce concern given the public POC availability and practical exploitability. Organizations using LatePoint should prioritize patching, but enterprises not using this plugin face no direct risk.

An attacker discovers a WordPress site running LatePoint and identifies the plugin is active. By intercepting or crafting HTTP requests to the booking or appointment management endpoints, the attacker modifies user-controlled parameters (such as appointment ID or customer ID) to values they do not own. Due to insufficient authorization checks, the application returns sensitive data or allows the attacker to view, modify, or cancel appointments belonging to other customers. The attacker can enumerate multiple IDs sequentially to extract customer contact information, payment details, or appointment schedules without authentication. A proof-of-concept demonstrating this parameter manipulation is publicly available via Patchstack, making exploitation straightforward for moderately skilled attackers.