Latepoint CVE-2026-5234

The vulnerability requires no authentication, no special configuration beyond default LatePoint installation, and no user interaction. However, full impact (Stripe payment secret exposure) is only realized on sites with Stripe Connect actively configured and connected to a Stripe account. Sites running LatePoint without Stripe Connect are vulnerable to IDOR enumeration and unauthorized transaction_intent record creation, but do not leak cryptographic payment tokens. The public action OsStripeConnectController::create_payment_intent_for_transaction must be registered in WordPress-which occurs automatically when the plugin is installed-for any exploitation to be possible. Non-default conditions that limit real-world risk: (1) If the WordPress installation has WAF/firewall rules blocking admin-ajax.php requests from public sources, enumeration is prevented. (2) If the LatePoint plugin is installed but Stripe Connect is not configured in plugin settings, payment secret leakage does not occur, though IDOR still allows invoice data access. (3) If invoice_id is not sequential in the target database (e.g., using UUIDs or random IDs), enumeration becomes computationally harder but IDOR via crafted POST requests to known invoice IDs still succeeds if the attacker can guess or infer valid IDs from other sources.

The CVSS score of 5.3 (Network, Low Complexity, No Privileges, No User Interaction, Unchanged Scope) reflects an integrity impact with no confidentiality loss scored in the base vector; however, this significantly underrepresents the true risk. The vulnerability exhibits multiple severe real-world risk signals that elevate practical severity: (1) Unauthenticated network access (AV:N/AC:L/PR:N) means any attacker globally can exploit this with trivial automation, (2) The description explicitly confirms information disclosure of Stripe payment_intent_client_secret tokens and customer financial data-contradicting the C:N rating and suggesting the CVSS vector may be incomplete or improperly scored, (3) Sequential enumeration enables adversaries to systematically extract payment secrets and customer IDs from all invoices on the site, (4) Affected sites with Stripe Connect enabled leak live payment processing credentials that can be replayed, (5) No public exploit code is known at the time of analysis, but exploitation is trivial (HTTP request with sequential ID parameters) and requires zero knowledge of target internals. SSVC analysis: exploitation is Proof-of-Concept (no active KEV), technical impact is High (payment credential exposure, data breach), automatable is Yes. The disconnect between CVSS scoring (integrity-only) and description (confidentiality + integrity) warrants independent verification of whether Stripe token exposure should be scored as Critical (C:H). For defenders: prioritize this as Critical on any LatePoint installation with Stripe Connect enabled; treat as High priority even without Stripe due to customer enumeration and IDOR patterns.

An attacker sends unauthenticated HTTP requests to a WordPress site running LatePoint ≤5.3.2, invoking the OsStripeConnectController::create_payment_intent_for_transaction action with sequential invoice_id parameters (1, 2, 3, etc.). For each request, the endpoint returns error messages or success responses that reveal whether the invoice exists, allowing enumeration of all valid invoices. Once invoice IDs are enumerated, the attacker repeats requests with valid IDs and extracts the response payload containing sensitive financial data (customer_id, charge_amount, order_id) and, if Stripe Connect is enabled, live Stripe payment_intent_client_secret tokens. The attacker can then use these secrets to view, modify, or process payments on any enumerated invoice.