EUVD-2026-100901
GHSA-3pf7-5297-2ffv
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach public latepoint_route_call AJAX route
-
ExploitSubmit incrementing booking[id]/cart[id] values
-
ImpactRead exposed booking and checkout JSON
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Object-level authorization, IDOR prevention
|
| Exploitation Conditions | No special conditions beyond the LatePoint plugin being installed and active at version 5.7.3 or earlier with existing booking/cart records - remote unauthenticated exploitation against default configurations, since the steps__reload_booking_form_summary_panel and steps__start routes are exposed via wp_ajax_nopriv_latepoint_route_call and require no login. The vendor's ownership guard exists only inside OsStepsHelper::load_step() and does not cover these sibling routes or the cart[id] parameter at all. The only practical limiting factors are that impact is read-only (no data modification), that identifiers are sequential integers (making enumeration easy rather than a barrier), and that there must be real bookings/carts present to disclose. |
| Impact | This is a genuine, easily-exploitable information-disclosure flaw rather than an inflated high-CVSS issue. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N = 7.5) is internally consistent with the description: the vulnerable routes (steps__reload_booking_form_summary_panel and steps__start) are reachable over the network through wp_ajax_nopriv_latepoint_route_call with no privileges, no complexity barriers, and no user interaction, and the sequential primary-key IDs make enumeration trivial and automatable. The CWE-639 (IDOR) classification aligns with the described missing ownership check. However, several corroborating risk signals are ABSENT from the input: no EPSS probability was supplied, there is no CISA KEV listing, and no public exploit code is referenced - so there is no public exploit identified at time of analysis. The impact is confidentiality-only (I:N/A:N): attackers can read, but not modify or destroy, other customers' appointment and checkout data. One point to verify independently is whether C:H is warranted - the disclosed data is customer PII (names implicitly, service, agent, date/time, price, checkout contents), which supports a high confidentiality rating, though some assessors might score it C:L; treat the 7.5 as a reasonable upper-middle estimate. Priority should be elevated for sites handling sensitive scheduling/PII, but the lack of KEV/EPSS/POC data means this is currently a theoretically trivial but not confirmed-weaponized issue. |
| Exploit ScenarioDerived | An unauthenticated attacker scripts repeated POST requests to the public latepoint_route_call AJAX endpoint, incrementing the booking[id] or cart[id] parameter across sequential integers. Because no ownership check is enforced on these sibling routes, each response returns another customer's appointment details or pending checkout contents directly in JSON, letting the attacker harvest the entire customer base. No public exploit code is referenced in the input, but the low attack complexity (AC:L) and absence of authentication (PR:N) make a working scraper trivial to build. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Unauthenticated information disclosure in the LatePoint appointment booking and scheduling plugin for WordPress (versions up to and including 5.7.3) lets any remote attacker read other customers' appointment records and pending cart contents by supplying sequential booking[id] and cart[id] values to the public steps__reload_booking_form_summary_panel and steps__start routes, which are reachable without login through wp_ajax_nopriv_latepoint_route_call. No ownership check is applied to those identifiers, so enumeration is trivial and requires no authentication, no user interaction and no special configuration beyond having the plugin active with live booking or cart data; the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, 7.5) confirms remote unauthenticated exploitation with confidentiality-only impact, and the readiness of sequential integer keys makes the practical barrier to exploitation very low. No public exploit code has been identified at time of analysis, the flaw is not listed in CISA KEV, and EPSS data was not available in the supplied intelligence; the assessment is that this is a genuine, easily reproducible read-only disclosure rather than an inflated high-severity score.
RemediationAI
The primary fix is to update the LatePoint plugin past the vulnerable 5.7.3 boundary as soon as a patched release is available; the provided references include a plugin Trac changeset (r3728691) that appears to carry the upstream correction, but an exact fixed version number is not independently confirmed in the supplied data, so administrators should verify the changelog on the plugin's WordPress.org page or the Wordfence advisory before assuming a specific build is safe. Until an update is applied, the highest-fidelity compensating control is to block or filter unauthenticated requests to the plugin's AJAX route: add a WAF or reverse-proxy rule that rejects POSTs to /wp-admin/admin-ajax.php where the action parameter is latepoint_route_call and the route is steps__start or steps__reload_booking_form_summary_panel, or more broadly deny booking/cart identifiers submitted by clients that do not hold a matching session cookie. The trade-off is that the same nopriv route legitimately serves the anonymous booking wizard, so an over-broad block breaks public booking for logged-out visitors, and a narrow route-level block must be tested against the site's wizard flow. Disabling the LatePoint plugin entirely removes the exposure but also takes the booking system offline. Because the routes are nopriv by design, simply requiring authentication is not a viable workaround. Additional monitoring value comes from reviewing web-server and plugin logs for sequential booking[id] or cart[id] values issued from a single source, which indicates enumeration, and from treating any exposed appointment or checkout data as a privacy incident. If a site cannot patch or filter, restricting the booking endpoint to known networks or placing the site behind an authenticated reverse proxy are blunt but effective options at the cost of public usability.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The issue is an instance of CWE-639, authorization bypass through a user-controlled key, in a WordPress plugin written in PHP. LatePoint registers AJAX entry points under WordPress's admin-ajax.php, including the nopriv variant wp_ajax_nopriv_latepoint_route_call, which is intentionally reachable by logged-out visitors because the booking wizard must work for anonymous site visitors. The steps__reload_booking_form_summary_panel and steps__start routes are handled by lib/controllers/steps_controller.php (around lines 145 and 290) and delegate object resolution to OsStepsHelper::set_required_objects() in lib/helpers/steps_helper.php (roughly lines 234, 1232 and 3228). That helper passes raw request parameters straight into set_booking_object() and set_cart_object(), which in turn call OsModel::set_data() in lib/models/model.php (around line 580) to load a row purely by primary key. No check ties the requested booking or cart row back to the current session or user, so any integer accepted by the model is returned. Critically, the ownership guard the vendor added in response to an earlier disclosure lives only inside OsStepsHelper::load_step() and therefore covers neither these sibling routes nor the cart[id] parameter at all, meaning the previous fix was incomplete rather than absent. Because booking and cart identifiers are auto-increment integers, an attacker can walk them and harvest JSON responses containing service name, assigned agent, date/time, duration, price breakdown and booking status, plus the contents of other shoppers' pending checkouts. The plugin's bootstrap file (latepoint.php, around line 1072) wires these routes, and the affected code is present in the 5.7.3 tag referenced in the advisory links.
Know when Latepoint gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Public unauthenticated nopriv AJAX routes give AV:N/PR:N/UI:N/AC:L; disclosure of other customers' PII and checkout data justifies C:H, with no integrity or availability impact (I:N/A:N).
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
DescriptionCVE.org
The Appointment Booking Plugin - LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 5.7.3 via the booking[id] and cart[id] parameters on the steps__reload_booking_form_summary_panel and steps__start public routes (reachable through wp_ajax_nopriv_latepoint_route_call). This is due to OsStepsHelper::set_required_objects() feeding raw request parameters into set_booking_object() and set_cart_object(), which call OsModel::set_data() and load an arbitrary booking or cart row by primary key with no ownership check - the ownership guard the vendor added for the earlier disclosure lives only inside OsStepsHelper::load_step() and does not cover the sibling routes or cart[id] at all. This makes it possible for unauthenticated attackers to enumerate sequential booking / cart identifiers and read other customers' appointment details (service name, agent, date/time, duration, price breakdown, status) and other shoppers' pending checkout contents directly from the JSON responses.
Executive ViewAI
The LatePoint appointment booking and scheduling plugin for WordPress, versions up to and including 5.7.3, exposes customer appointment records and pending cart contents to any unauthenticated visitor through a simple identifier enumeration flaw. This affects organizations using the plugin for bookings and can lead to customer PII exposure, regulatory scrutiny, and reputational damage. No public exploit identified at time of analysis, but no vendor-released patch identified at time of analysis, so mitigation must be immediate.
No vendor-released patch identified at time of analysis; interim mitigations include disabling LatePoint if not essential, blocking unauthenticated access to the affected AJAX routes via WAF/reverse proxy, restricting wp_ajax_nopriv_latepoint_route_call, monitoring for sequential identifier enumeration, limiting stored booking and cart data, and applying vendor patch when available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
The LatePoint plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 5.0.12. Rate
The LatePoint plugin for WordPress is vulnerable to Arbitrary User Password Change via SQL Injection in versions up to,
The LatePoint Plugin plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a
Blind SQL injection in the LatePoint WordPress appointment-booking plugin (versions up to and including 5.6.3) lets remo
LatePoint WordPress plugin through 5.7.4 allows unauthenticated remote attackers who know a target customer's registered
Unauthenticated arbitrary shortcode execution in LatePoint (Appointment Booking Plugin - Calendar & Scheduling for WordP
Privilege escalation in the LatePoint appointment booking plugin for WordPress (all versions up to and including 5.7.3)
Privilege escalation in the LatePoint booking plugin for WordPress (versions ≤ 5.4.1) lets an authenticated user holding
Privilege escalation to Administrator in the LatePoint booking plugin for WordPress (versions up to and including 5.6.3)
Cross-Site Request Forgery (CSRF) vulnerability in Latepoint LatePoint allows Cross Site Request Forgery.9.91. Rated hig
Privilege escalation in the LatePoint Calendar Booking plugin for WordPress (versions up to and including 5.5.1) allows
Unauthenticated SQL injection in the LatePoint WordPress plugin (versions up to and including 5.7.2) allows remote attac
Exploit-DB