LatePoint CVE-2026-96662

Exploitation requires reaching the LatePoint booking flow - specifically a request carrying the 'booking[service_id]' parameter to the plugin's booking-step handling - on any WordPress site with LatePoint version ≤5.7.2 installed and active; the booking functionality is the plugin's core feature and is exposed to unauthenticated visitors by default, so no non-default configuration, authentication, or user interaction is needed. Limiting factors are narrow: the site must run the vulnerable plugin version with booking pages reachable. The impact is bounded to confidentiality (database read/extraction); the flaw does not, by the CVSS vector, grant data modification (I:N) or availability impact (A:N).

This is a credible, actionable priority despite the absence of exploitation telemetry. The provided CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base 7.5) describes an unauthenticated, network-reachable, low-complexity SQL injection requiring no user interaction - the easiest class of flaw to weaponize and automate against public-facing WordPress sites. The impact profile is confidentiality-only (C:H, I:N, A:N), consistent with the description's claim of data extraction rather than modification or takeover. No EPSS score, no CISA KEV listing, and no explicit POC indicator were supplied, so by the precision rules this is 'no public exploit identified at time of analysis'; however, unauthenticated CWE-89 flaws in popular WordPress plugins are historically rapid targets for mass scanning once a patch diff is public, and the input includes a WordPress.org changeset link that effectively discloses the fix location. No signals conflict here - the description (unauthenticated) and the CVSS vector (PR:N) agree. The main caveat is that risk severity (high) is distinct from real-world exploitation volume, which cannot be confirmed from the data provided (EPSS and KEV both absent).

An unauthenticated attacker locates a WordPress site running LatePoint and submits a booking-step request with a malicious 'booking[service_id]' value, appending SQL to the plugin's unprepared query. Because no authentication or user interaction is needed, the attacker extracts sensitive database contents (e.g. user data, WordPress secrets, or session/credential material) directly in responses or via inference. No public exploit is identified at time of analysis, but the vulnerable source lines are disclosed in the referenced WordPress.org trac links.