What is the CVSS score of CVE-2026-5234?

CVE-2026-5234 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.1%.

Latepoint CVE-2026-5234

EUVD-2026-23356 MEDIUM

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-04-17 Wordfence

WordPress Authentication Bypass Oracle Latepoint Latepoint Calendar Booking Plugin For Appointments And Events Wordpress Plugin

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 17, 2026 - 04:41 vuln.today

EUVD ID Assigned

Apr 17, 2026 - 04:30 euvd

EUVD-2026-23356

Analysis Generated

Apr 17, 2026 - 04:30 vuln.today

CVE Published

Apr 17, 2026 - 03:36 nvd

MEDIUM 5.3

DescriptionCVE.org

The LatePoint plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.3.2. The vulnerability exists because the OsStripeConnectController::create_payment_intent_for_transaction action is registered as a public action (no authentication required) and loads invoices by sequential integer invoice_id without any access_key or ownership verification. This is in contrast to other invoice-related actions (view_by_key, payment_form, summary_before_payment) in OsInvoicesController which properly require a cryptographic UUID access_key. This makes it possible for unauthenticated attackers to enumerate valid invoice IDs via an error message oracle, create unauthorized transaction intent records in the database containing sensitive financial data (invoice_id, order_id, customer_id, charge_amount), and on sites with Stripe Connect configured, the response also leaks Stripe payment_intent_client_secret tokens, transaction_intent_key values, and payment amounts for any invoice.

AnalysisAI

LatePoint WordPress plugin versions up to 5.3.2 expose a public, unauthenticated endpoint (OsStripeConnectController::create_payment_intent_for_transaction) that allows sequential enumeration of invoice IDs and unauthorized creation of transaction intent records containing sensitive financial data, customer identifiers, and Stripe payment secrets. Unauthenticated remote attackers can exploit this Insecure Direct Object Reference (IDOR) vulnerability to leak confidential payment information and Stripe Connect tokens without authentication or user interaction. No active exploitation has been confirmed at the time of analysis.

Technical ContextAI

LatePoint is a WordPress calendar and appointment booking plugin that integrates Stripe Connect for payment processing. The vulnerability stems from a critical design flaw in the OsStripeConnectController class: the create_payment_intent_for_transaction action is registered as a public WordPress action without authentication checks, and it retrieves invoice records using only a sequential numeric invoice_id parameter. Unlike properly secured invoice endpoints in OsInvoicesController (view_by_key, payment_form, summary_before_payment) which enforce a cryptographic UUID access_key for authorization, this endpoint performs no ownership or access verification. The CWE-639 classification (Authorization Bypass Through User-Controlled Key) reflects the fundamental flaw: sequential integer IDs are trivially enumerable, and the endpoint creates database records (transaction_intent records) containing sensitive financial metadata without validating that the requester owns or has permission to access the invoice. When Stripe Connect is configured, the response leaks payment_intent_client_secret tokens-cryptographic materials required to process payments-making this a high-severity information disclosure vulnerability despite the modest CVSS score.

RemediationAI

Upgrade LatePoint to version 5.3.3 or later immediately, as the plugin repository commits (visible at https://plugins.trac.wordpress.org/changeset/3505127/latepoint/trunk/lib/controllers/stripe_connect_controller.php) confirm the vulnerability has been patched by adding proper authentication checks and ownership verification to OsStripeConnectController::create_payment_intent_for_transaction. If immediate upgrade is not possible, implement the following compensating controls: (1) Disable Stripe Connect integration if not actively used by navigating to LatePoint settings and unchecking Stripe Connect; this prevents leakage of payment_intent_client_secret but does not stop IDOR enumeration. (2) Restrict HTTP access to the WordPress admin-ajax.php endpoint from which OsStripeConnectController actions are invoked (action=os_stripe_connect_create_payment_intent_for_transaction) using a Web Application Firewall (WAF) rule or nginx/Apache configuration to allow only known legitimate frontend sources; this degrades user experience for legitimate customers but blocks automated enumeration attacks. (3) Monitor database transaction_intent records for unusual creation patterns (e.g., bulk creation across sequential invoice IDs) as an interim detection control. These mitigations are temporary; upgrade to 5.3.3+ is mandatory for proper remediation. Wordfence provides real-time updates at the advisory link above.