LatePoint EUVD-2026-90479

Exploitation requires that the site exposes LatePoint's public/unauthenticated booking flow (the plugin's primary intended function, so typically enabled by default) and that the Customer Cabinet block / dashboard rendered by render_customer_dashboard() is reachable so the stored customer name is emitted into the content stream where WordPress core's do_shortcode filter at priority 11 re-parses it. No authentication, user interaction, or special privilege is needed to plant the payload (PR:N/UI:N). The practical limiting factor is deployment-dependent: the vulnerability only has effect on sites that actually use the Customer Cabinet dashboard rendering path and have exploitable shortcodes registered; the concrete impact scales with which shortcodes (core or third-party) are available to be invoked. Affected: all versions up to and including 5.7.0.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N = 9.1 Critical) describes a fully remote, unauthenticated, low-complexity flaw requiring no user interaction, which for a widely-sold WordPress booking plugin is a genuine priority. The real-world impact hinges on CWE-94 arbitrary shortcode execution: WordPress do_shortcode re-parses the stored customer name at priority 11 when render_customer_dashboard() emits it, so the attacker's reachable capability depends on which shortcodes are registered on the target site (core plus any active plugins/themes) - this can range from information disclosure and content manipulation up to code-execution-adjacent abuse, justifying the vendor's C:H/I:H but leaving A:N appropriately unset. No EPSS score, CISA KEV listing, or public exploit was provided in the intelligence, so exploitation status is 'no public exploit identified at time of analysis'; the absence of EPSS/KEV does not lower the structural risk given the trivial, unauthenticated injection vector and a popular affected product. The one caveat is that exploitation is only meaningful where the Customer Cabinet block is deployed and a dashboard render path exposes the planted name - this is a realistic default for the plugin's intended use but is a site-configuration dependency rather than a guaranteed universal condition.

An unauthenticated attacker proceeds through LatePoint's public booking flow and supplies a customer name field containing WordPress shortcode syntax instead of a real name, which the plugin stores without validating against do_shortcode. When the Customer Cabinet dashboard subsequently renders that name into the content stream, WordPress core's do_shortcode filter re-parses and executes the embedded shortcode(s), letting the attacker abuse any registered shortcode on the site. No public proof-of-concept was supplied in the intelligence, but the attack requires only network access and a normal booking submission.