What is the CVSS score of CVE-2026-57714?

CVE-2026-57714 has a CVSS 3.1 base score of 9.3 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.4%.

Which versions of LatePoint are affected by CVE-2026-57714?

The LatePoint WordPress appointment-booking plugin (versions 5.6.3 and earlier) contains a critical remote vulnerability allowing unauthenticated attackers to extract customer appointment data and…

How to fix or mitigate CVE-2026-57714?

Within 24 hours, audit all WordPress installations to identify LatePoint plugin presence and document version numbers (vulnerable: versions 5.6.3 and earlier); simultaneously create full backups of WordPress and MySQL databases to enable rapid recovery if breach is detected. Within 7 days, either uninstall LatePoint entirely or-if business-critical-disable the plugin and deploy Web Application Firewall rules to block SQL injection patterns targeting appointment-booking endpoints, restrict MySQL database user account privileges to read-only access where possible, and enable comprehensive database query logging with alerts for suspicious SQL patterns. Within 30 days, monitor official WordPress plugin repository and Patchstack for patch release; validate any available patch in non-production environment before staged deployment across all affected systems. Maintain continuous monitoring of database access logs and network traffic for indicators of exploitation attempts until patch is deployed.

LatePoint CVE-2026-57714

EUVD-2026-43369 CRITICAL

SQL Injection (CWE-89)

2026-07-13 Patchstack

WordPress SQLi Latepoint Wordpress Plugin

9.3

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

9.3 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

vuln.today AI

9.3 CRITICAL

Remote unauthenticated blind SQLi over the network (AV:N/AC:L/PR:N/UI:N); scope change to the shared DB and high confidentiality read, with no integrity and only low availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 10:47 vuln.today

CVE Published

Jul 13, 2026 - 08:41 cve.org

CRITICAL 9.3

DescriptionCVE.org

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LatePoint LatePoint latepoint allows Blind SQL Injection.This issue affects LatePoint: from n/a through <= 5.6.3.

AnalysisAI

Blind SQL injection in the LatePoint WordPress appointment-booking plugin (versions up to and including 5.6.3) lets remote unauthenticated attackers inject crafted SQL through improperly neutralized input (CWE-89), enabling extraction of database contents via boolean/time-based inference. Reported by Patchstack and rated CVSS 9.3 with a network vector requiring no privileges or user interaction; the changed scope reflects access to the shared WordPress/MySQL database beyond the plugin's own boundary. No public exploit is identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

LatePoint is a commercial WordPress plugin providing online appointment scheduling and booking for service businesses; it runs inside the WordPress PHP environment and reads/writes to the site's shared MySQL/MariaDB database. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command): user-controllable input reaches a database query without proper parameterization or escaping, letting an attacker alter the query's logic. The 'blind' qualifier indicates results are not returned directly in the HTTP response, so data is inferred through boolean or time-based side channels - slower to exploit but functionally equivalent for data exfiltration. Because WordPress plugins share the single wp_ database, injection here can reach core tables such as wp_users and wp_options.

RemediationAI

Upgrade LatePoint to a release newer than 5.6.3 as published by the vendor; the input data does not specify an exact fixed version, so consult the Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/latepoint/vulnerability/wordpress-latepoint-plugin-5-6-3-sql-injection-vulnerability) and the LatePoint changelog for the first patched build and update immediately - patch available per vendor advisory, but a specific fixed version is not independently confirmed from the provided data. Until patched, place the site behind a WAF (such as Patchstack's or a comparable WordPress firewall) with SQL-injection rules tuned to LatePoint's booking endpoints, and restrict or rate-limit public access to the booking/AJAX request handlers the plugin exposes; note that WAF rules can be bypassed and may block legitimate booking traffic if too aggressive. If LatePoint is not actively used, deactivate and remove the plugin to eliminate the attack surface, and audit the database and access logs for signs of prior injection given the blind nature makes exploitation stealthy.