LatePoint EUVD-2026-107145

Exploitable only against sites running the LatePoint plugin (before 5.7.5) that offer bookings with a chargeable amount through LatePoint's own payment/checkout flow - the attack targets the client-supplied value that determines the booking charge. No authentication, user interaction, or non-default configuration is required for a visitor to submit a booking, so against any site accepting paid LatePoint bookings this is remote and unauthenticated; the practical limiting factor is simply that the site must be using LatePoint for paid appointments and still be on a pre-5.7.5 version. Impact is limited to obtaining services/orders without payment (integrity), not data exposure or denial of service.

This is a business-logic / improper-input-validation flaw (client-controlled price tampering) in the LatePoint WordPress booking plugin. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N = 5.3, Medium) is internally consistent with the description: remotely reachable, low-complexity, no authentication, no user interaction, with only a limited integrity impact (C:N/A:N, I:L) because the attacker tampers with order/booking records rather than reading data or affecting availability. A public exploit exists (WPScan), which raises practical risk, but there is no CISA KEV entry and no EPSS score was supplied, so there is no evidence of widespread automated exploitation at this time. The real-world impact is financial/fraud rather than system compromise - an attacker obtains services (and a recorded order) without paying - so a mid-range CVSS of 5.3 likely understates business impact for monetized sites while correctly reflecting the limited technical impact to the system itself. NOTE a labeling conflict: the input tags this as 'Information Disclosure', which contradicts the CVSS (C:N, I:L) and the description - this is a payment-bypass/integrity issue, not disclosure. Treat this as a moderate, worth-patching priority (public PoC, unauthenticated, trivial to trigger) rather than an emergency, scaled up for sites that depend on LatePoint for paid revenue.

An unauthenticated visitor on a WordPress site running vulnerable LatePoint initiates a normal paid booking and intercepts/modifies the client-supplied amount value so the amount due resolves to zero, then submits the request. The booking is confirmed and an order is recorded with no payment taken, effectively obtaining paid services for free. A public exploit from WPScan exists, and with AV:N/AC:L/PR:N/UI:N the attack is remote, low-complexity, and requires no login or user interaction.