LatePoint CVE-2026-94432

Exploitation requires that the LatePoint plugin (≤5.7.1) is installed and active on WordPress, and that the PayPal payment processor path is reachable - the vulnerable OsPaypalConnectController::create_order_for_transaction() is registered as a public wp_ajax_nopriv_latepoint_route_call route, so it is callable without authentication regardless of login. No special non-default configuration, user interaction, or credentials are needed to reach the IDOR, since the missing ownership/access-key check occurs before the PayPal-configured guard. The main LIMITING factors: meaningful intent_key overwrite impact requires a target invoice to have an in-flight NEW-status transaction intent (i.e., a victim mid-checkout via Stripe/Razorpay), and invoice targeting relies on guessing/iterating sequential integer invoice_id values.

This is a medium-severity, high-reachability access-control flaw whose signals are internally consistent but modest. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms a fully remote, unauthenticated, low-complexity path - the handler is deliberately exposed via wp_ajax_nopriv_latepoint_route_call, so no privileges or user interaction are needed, which maximizes exposure. However, impact is bounded: the official score sets C:N/I:L/A:N for a 5.3, reflecting that the primary damage is unauthorized creation/overwrite of transaction-intent rows and invoice enumeration rather than code execution or full data theft. No KEV listing and no EPSS score were provided in the input, and no public exploit is referenced, so there is no evidence of active exploitation or weaponization. The practical priority is driven by trivial reachability plus a concrete integrity/denial effect on payment flows (overwriting intent_key breaks in-flight Stripe/Razorpay webhooks), not by raw severity. Note a mild tension: the NVD vector records C:N, yet the description explicitly states attackers can 'enumerate invoices belonging to arbitrary customers,' which implies at least limited confidentiality exposure - this is a candidate discrepancy worth verifying with the Wordfence advisory. Overall: a real, easily reachable bug worth patching promptly on affected sites, but not a drop-everything critical absent exploitation data.

An unauthenticated attacker sends crafted latepoint_route_call AJAX requests to the PayPal create_order_for_transaction endpoint, iterating the sequential integer invoice_id to target other customers' invoices. Because no access-key UUID or ownership check is enforced (unlike the Stripe/Razorpay handlers that require a 128-bit key), the attacker creates transaction-intent rows tied to victim customers and regenerates the intent_key of in-flight NEW-status intents, invalidating keys that legitimate payment webhooks depend on. No public proof-of-concept is referenced in the provided data.