LatePoint CVE-2026-91050

Exploitation requires sending requests to the plugin's publicly reachable steps__start and steps__load_step booking routes with a params[presets][order_item_id] parameter set to an order item ID belonging to another customer; supplying any non-empty value triggers the is_bundle_scheduling() path, which removes the customer and payment steps and skips ownership, bundle-membership, paid-status, and remaining-capacity checks. The practical limiting factor is that the attacker must know or guess a valid order_item_id of a target customer; no special plugin configuration or deployment mode is needed, and per the description no authentication is required (contradicting the supplied PR:L). Scope is limited to the booking/order data of the referenced order item (victim name, email, order code) and creation of appointments against it - no server code execution or availability impact.

This is a genuine but moderate-priority authorization flaw (CWE-639 IDOR / Missing Authorization) reported by Wordfence in the widely-used LatePoint booking plugin. The CVSS vector supplied (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N = 4.3) indicates network-reachable, low-complexity exploitation with only low integrity impact and no confidentiality impact. However, the signals conflict: the description explicitly states the steps__start and steps__load_step routes are 'publicly reachable' and exploitable by 'unauthenticated attackers,' which contradicts the PR:L in the vector, and it describes disclosure of other customers' names, email addresses, and order codes, which contradicts C:N. Treating the description as authoritative raises real-world risk above what the 4.3 base score suggests. There is no EPSS score, no CISA KEV listing, and no SSVC decision data provided, and no public exploit identified at time of analysis, so there is no evidence of active exploitation - this is a disclosure-and-tampering issue against a single tenant's data rather than a wormable RCE. Net: a legitimate priority for LatePoint operators handling customer PII, but not an emergency; the low complexity and (per description) lack of authentication mean it should be patched promptly.

An attacker browsing a WordPress site running LatePoint submits a booking request to the public steps__start/steps__load_step endpoints with a params[presets][order_item_id] value belonging to another customer. Because is_bundle_scheduling() only checks that order_item_id is non-empty, the plugin skips the customer and payment steps, creates an approved appointment against the victim's order item, and returns the victim's name, email, and order code in the booking confirmation. No public exploit code has been identified, but the attack requires only crafted HTTP requests and low complexity (AC:L).