What is the CVSS score of CVE-2026-5356?

CVE-2026-5356 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.2%.

Which versions of LatePoint are affected by CVE-2026-5356?

The LatePoint Calendar Booking plugin for WordPress (versions ≤5.4.0) contains a payment bypass vulnerability allowing unauthenticated attackers to complete bookings while paying arbitrary amounts,…

How to fix or mitigate CVE-2026-5356?

24 hours: Identify all WordPress instances running LatePoint; disable the plugin if not operationally critical. 7 days: If LatePoint is required, implement mandatory manual approval of all bookings before fulfillment and enable Stripe webhook signature verification. 30 days: Establish monitoring of Stripe transaction logs for anomalies and establish vendor communication plan for patched version status.

LatePoint CVE-2026-5356

EUVD-2026-42227 HIGH

Missing Authorization (CWE-862)

2026-07-08 Wordfence

GHSA-jrp6-4xgv-3wr7

WordPress Authentication Bypass Latepoint Latepoint Calendar Booking Plugin For Appointments And Events Wordpress Plugin

7.5

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

vuln.today AI

7.5 HIGH

Unauthenticated network checkout endpoint (AV:N/PR:N/UI:N), simple token replay (AC:L); impact is payment-integrity only, so I:H with C:N and A:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 08, 2026 - 13:16 vuln.today

CVE Published

Jul 08, 2026 - 12:33 cve.org

HIGH 7.5

DescriptionCVE.org

The LatePoint - Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Improper Input Validation in all versions up to, and including, 5.4.0. This is due to the plugin's Stripe Connect payment processor accepting a client-supplied PaymentIntent ID. This makes it possible for unauthenticated attackers to pay an arbitrary amount by supplying a previously succeeded PaymentIntent token.

AnalysisAI

Payment amount manipulation in the LatePoint Calendar Booking plugin for WordPress (versions up to and including 5.4.0) lets unauthenticated attackers finalize bookings while paying an arbitrary amount. The Stripe Connect payment processor trusts a client-supplied PaymentIntent ID, so an attacker can replay a previously succeeded PaymentIntent token to satisfy the payment check. No public exploit identified at time of analysis, and the flaw is not in CISA KEV.

Technical ContextAI

LatePoint is a commercial appointment/event booking plugin for WordPress that integrates with Stripe via the Stripe Connect flow. In a correct Stripe integration, the server creates and controls the PaymentIntent, then verifies its status and amount server-side against the order total before confirming the booking. Here the plugin instead accepts a PaymentIntent ID supplied by the client and treats a 'succeeded' status as proof of payment, without binding that PaymentIntent to the specific booking amount, currency, or order. This maps to CWE-862 (Missing Authorization) - the code fails to enforce that the presented payment token actually corresponds to a valid, sufficient payment for this transaction. The affected component is identified by CPE cpe:2.3:a:latepoint:latepoint_-_calendar_booking_plugin_for_appointments_and_events:*:*:*:*:*:*:*:*.

RemediationAI

Upstream fix available (PR/commit); released patched version not independently confirmed - the corrective code change is published in WordPress plugin trac changeset 3509569 (https://plugins.trac.wordpress.org/changeset/3509569/latepoint), so administrators should update LatePoint to the latest available release beyond 5.4.0 as distributed through that changeset and review the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/1b1338c4-36a8-47b0-b3cf-c5dc690f8c1c?source=cve). Until updated, a targeted compensating control is to switch the LatePoint payment method away from the vulnerable client-supplied Stripe Connect flow (for example to an alternative gateway or manual/offline payment confirmation), accepting the trade-off of reduced checkout automation. Additionally, reconcile Stripe dashboard payments against LatePoint bookings to detect underpaid or reused PaymentIntents, and consider a WAF rule to flag repeated or externally-sourced PaymentIntent IDs at the booking endpoint, noting this is detective rather than fully preventive.