Appointment Booking Plugin Latepoint Calendar Scheduling For Wordpress
Monthly
LatePoint WordPress plugin through 5.7.4 allows unauthenticated remote attackers who know a target customer's registered email address or phone number to bypass OTP authentication by racing the attempts counter and brute-forcing the 6-digit code, potentially taking over that customer's account, bookings, and personal data. Exploitation requires the site to use LatePoint's OTP/passwordless login flow and the attacker to win a concurrency race while guessing the code; no public exploit identified at time of analysis.
Unauthenticated information disclosure in the LatePoint appointment booking and scheduling plugin for WordPress (versions up to and including 5.7.3) lets any remote attacker read other customers' appointment records and pending cart contents by supplying sequential booking[id] and cart[id] values to the public steps__reload_booking_form_summary_panel and steps__start routes, which are reachable without login through wp_ajax_nopriv_latepoint_route_call. No ownership check is applied to those identifiers, so enumeration is trivial and requires no authentication, no user interaction and no special configuration beyond having the plugin active with live booking or cart data; the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, 7.5) confirms remote unauthenticated exploitation with confidentiality-only impact, and the readiness of sequential integer keys makes the practical barrier to exploitation very low. No public exploit code has been identified at time of analysis, the flaw is not listed in CISA KEV, and EPSS data was not available in the supplied intelligence; the assessment is that this is a genuine, easily reproducible read-only disclosure rather than an inflated high-severity score.
Customer account takeover in the Appointment Booking Plugin - LatePoint | Calendar & Scheduling for WordPress through 5.7.2 is possible on sites that enable the 'Use WordPress users as customers' option: an authenticated Subscriber-level attacker whose own user_login equals a victim customer's email address causes their WordPress user ID to be linked into that victim's LatePoint customer row, exposing the victim's bookings, services, agents and calendar data and overwriting the victim's email address the next time the victim logs in. Exploitation is tightly conditional - it requires the opt-in WordPress-user integration, a Subscriber account (commonly obtainable when open registration is enabled), and prior knowledge of the target's email address, so the attack is per-victim and targeted rather than mass-exploitable; no public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS score was provided in the source data. The flaw has been assigned CVSS 7.4 with high confidentiality and integrity impact but no availability impact, and a fix appears to have shipped in the 5.7.3 release.
Unauthenticated SQL injection in the LatePoint WordPress plugin (versions up to and including 5.7.2) allows remote attackers to append arbitrary SQL queries via the 'booking[service_id]' parameter, enabling extraction of sensitive data from the database. The vulnerability is easily exploitable (CVSS 7.5) with no authentication or user interaction required, and affects the plugin's core booking functionality. No public exploit code or active exploitation has been identified at time of analysis, but the flaw poses a significant risk due to its low complexity and high confidentiality impact.
Privilege escalation in the LatePoint appointment booking plugin for WordPress (all versions up to and including 5.7.3) lets an authenticated LatePoint user who holds the settings__edit capability overwrite the default_wp_role_for_customer setting with 'administrator', so that any LatePoint customer account self-registered afterwards is created with full WordPress administrator rights. The flaw is entirely server-side - the role restriction exists only in the UI dropdown and is never validated when the setting is persisted - but it is gated by two real prerequisites: a WordPress administrator must first delegate settings__edit to an agent or custom role, and a new customer registration must occur after the malicious value is saved for the escalation to materialize. No public exploit code or confirmed active exploitation was identified at time of analysis, and the assessed vector (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) treats this as a genuine high-impact issue that nonetheless sits below its 8.8 headline score in practical priority.
Unauthenticated arbitrary shortcode execution in LatePoint (Appointment Booking Plugin - Calendar & Scheduling for WordPress) affects all versions up to and including 5.7.0, allowing an attacker to plant a shortcode payload via the public booking flow that is stored as the customer name and later executed when the Customer Cabinet block rendered by render_customer_dashboard() outputs the stored name into the content stream, where WordPress core's do_shortcode filter at priority 11 re-parses and runs it (CVSS 3.1 9.1, AV:N/AC:L/PR:N/UI:N). No authentication, user interaction, or special privilege is required to plant the payload, though practical impact is deployment-dependent: the site must expose LatePoint's public booking flow, the Customer Cabinet rendering path must be reachable, and exploitable shortcodes must be registered for the injected payload to have effect. At time of analysis no public exploit code has been identified.
Unauthenticated customer-record disclosure in the LatePoint appointment booking plugin for WordPress, affecting all versions up to and including 5.7.4, allows remote attackers to harvest the first name, last name, email address, phone number and notes of every customer in the database by enumerating UUID prefixes through the steps__load_step AJAX endpoint using the params[customer[uuid]] parameter. Exploitation is strictly gated on a non-default configuration: the plugin's 'Field used for authentication' setting must be set to 'Disable ability to login' (guest checkout mode), so sites using default login-based authentication are not exposed. No public exploit code was identified at time of analysis; the AC:H rating reflects the request-heavy prefix enumeration required, which rate limiting or a WAF may slow or detect but does not prevent on an unprotected site.
Sensitive information exposure in the LatePoint appointment-booking plugin for WordPress (all versions up to and including 5.7.3) allows an authenticated subscriber-level user to leak privileged booking data - administrator-only admin_notes, assigned agent internal contact details, transaction tokens, and payment request URLs - by storing a template placeholder such as {{customer_admin_notes}} in their own first_name field via the customer_cabinet__update route and then triggering the LatePoint password-reset/notification email flow, which expands the placeholder server-side and mails the result to the attacker's address. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, base 4.3) confirms network reachability with mandatory low-privilege authentication and only a limited confidentiality impact, with no effect on integrity or availability and no code execution or data modification; no public exploit identified at time of analysis, and exploitation depends on the site allowing self-registration or otherwise granting low-privilege accounts that can reach the customer cabinet update route.
Missing authorization in the LatePoint Appointment Booking plugin for WordPress (versions up to and including 5.7.2) allows unauthenticated attackers to create approved appointments against other customers' order items by sending a non-empty params[presets][order_item_id] to the publicly reachable steps__start and steps__load_step routes. The plugin's is_bundle_scheduling() discriminator is only an !empty(order_item_id) truthiness check, so supplying any value causes the booking flow to strip out the customer and payment steps and to skip ownership, bundle-membership, paid-status, and remaining-capacity validation. Successful requests leak the targeted customer's name, email address, and order code in the booking confirmation; exploitation is limited in practice by the need to know or guess a valid order item ID of a victim. No public exploit code or confirmed active exploitation was identified at time of analysis.
Authenticated attackers holding only Subscriber-level access can tamper with the personal records of arbitrary LatePoint customers on WordPress sites running the Appointment Booking & Reservation plugin through version 5.6.9. The process_step_customer() handler merges attacker-supplied POST data into an existing customer record while checking only is_user_logged_in(), so any logged-in account can rewrite another customer's first name, last name, email, phone, and notes; where the non-default contact_merge setting is 'phone', this escalates to overwriting the victim's email and enabling account takeover via password reset. Exploitation requires a valid low-privilege session (PR:L), which is trivial on sites with open registration, and there is no public exploit identified at time of analysis, though the EPSS-style risk is moderate rather than critical.
Unauthenticated remote attackers can enumerate and manipulate customer invoices in the WordPress plugin Appointment Booking Plugin - LatePoint | Calendar & Scheduling for WordPress through version 5.7.1, because the OsPaypalConnectController::create_order_for_transaction() handler is exposed as a public wp_ajax_nopriv_latepoint_route_call route and loads an OsInvoiceModel using a bare sequential integer invoice_id with no ownership or access-key check. An attacker who iterates invoice IDs can confirm the existence of invoices belonging to arbitrary customers and cause transaction-intent rows to be created against those invoices, and can overwrite the intent_key of any in-flight NEW-status transaction intent, breaking the Stripe/Razorpay checkout and webhook flows those customers are waiting on. No public exploit identified at time of analysis, and exploitation is limited in practice by the need to guess sequential IDs and by the fact that meaningful intent_key disruption requires a victim to be mid-checkout; the affected code path remains otherwise reachable without authentication and without user interaction.
Insecure Direct Object Reference in the LatePoint calendar booking plugin for WordPress (all versions up to and including 5.6.3) lets an authenticated LatePoint Agent-level user - or anyone with a higher role - read bookings and customer PII belonging to other agents and delete arbitrary bookings simply by supplying any booking ID, because the booking key is user-controlled and never checked against the caller's ownership. The CVSS vector (PR:L) confirms authentication is required, and the flaw is only reachable when an administrator has explicitly turned on the plugin's Abilities API toggles (latepoint_abilities_api plus latepoint_abilities_api_delete and/or latepoint_abilities_api_edit), which are not enabled by default and therefore substantially limit real-world exposure. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV); independent assessment rates this as a real but modestly-scoped, low-to-moderate priority issue affecting confidentiality and integrity within the agent population.
Stored Cross-Site Scripting in the LatePoint WordPress appointment booking plugin (all versions through 5.3.2) allows authenticated attackers with contributor-level access to inject persistent malicious scripts via the 'btn_wrapper_classes' attribute of the 'latepoint_resources' shortcode. The injected payload executes in any visitor's browser upon loading the affected page, enabling session hijacking, credential theft, or malicious redirects against site users. No public exploit code or active exploitation has been identified at time of analysis; however, the low privilege requirement expands the attacker pool on multi-contributor WordPress deployments.
LatePoint WordPress plugin through 5.7.4 allows unauthenticated remote attackers who know a target customer's registered email address or phone number to bypass OTP authentication by racing the attempts counter and brute-forcing the 6-digit code, potentially taking over that customer's account, bookings, and personal data. Exploitation requires the site to use LatePoint's OTP/passwordless login flow and the attacker to win a concurrency race while guessing the code; no public exploit identified at time of analysis.
Unauthenticated information disclosure in the LatePoint appointment booking and scheduling plugin for WordPress (versions up to and including 5.7.3) lets any remote attacker read other customers' appointment records and pending cart contents by supplying sequential booking[id] and cart[id] values to the public steps__reload_booking_form_summary_panel and steps__start routes, which are reachable without login through wp_ajax_nopriv_latepoint_route_call. No ownership check is applied to those identifiers, so enumeration is trivial and requires no authentication, no user interaction and no special configuration beyond having the plugin active with live booking or cart data; the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, 7.5) confirms remote unauthenticated exploitation with confidentiality-only impact, and the readiness of sequential integer keys makes the practical barrier to exploitation very low. No public exploit code has been identified at time of analysis, the flaw is not listed in CISA KEV, and EPSS data was not available in the supplied intelligence; the assessment is that this is a genuine, easily reproducible read-only disclosure rather than an inflated high-severity score.
Customer account takeover in the Appointment Booking Plugin - LatePoint | Calendar & Scheduling for WordPress through 5.7.2 is possible on sites that enable the 'Use WordPress users as customers' option: an authenticated Subscriber-level attacker whose own user_login equals a victim customer's email address causes their WordPress user ID to be linked into that victim's LatePoint customer row, exposing the victim's bookings, services, agents and calendar data and overwriting the victim's email address the next time the victim logs in. Exploitation is tightly conditional - it requires the opt-in WordPress-user integration, a Subscriber account (commonly obtainable when open registration is enabled), and prior knowledge of the target's email address, so the attack is per-victim and targeted rather than mass-exploitable; no public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS score was provided in the source data. The flaw has been assigned CVSS 7.4 with high confidentiality and integrity impact but no availability impact, and a fix appears to have shipped in the 5.7.3 release.
Unauthenticated SQL injection in the LatePoint WordPress plugin (versions up to and including 5.7.2) allows remote attackers to append arbitrary SQL queries via the 'booking[service_id]' parameter, enabling extraction of sensitive data from the database. The vulnerability is easily exploitable (CVSS 7.5) with no authentication or user interaction required, and affects the plugin's core booking functionality. No public exploit code or active exploitation has been identified at time of analysis, but the flaw poses a significant risk due to its low complexity and high confidentiality impact.
Privilege escalation in the LatePoint appointment booking plugin for WordPress (all versions up to and including 5.7.3) lets an authenticated LatePoint user who holds the settings__edit capability overwrite the default_wp_role_for_customer setting with 'administrator', so that any LatePoint customer account self-registered afterwards is created with full WordPress administrator rights. The flaw is entirely server-side - the role restriction exists only in the UI dropdown and is never validated when the setting is persisted - but it is gated by two real prerequisites: a WordPress administrator must first delegate settings__edit to an agent or custom role, and a new customer registration must occur after the malicious value is saved for the escalation to materialize. No public exploit code or confirmed active exploitation was identified at time of analysis, and the assessed vector (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) treats this as a genuine high-impact issue that nonetheless sits below its 8.8 headline score in practical priority.
Unauthenticated arbitrary shortcode execution in LatePoint (Appointment Booking Plugin - Calendar & Scheduling for WordPress) affects all versions up to and including 5.7.0, allowing an attacker to plant a shortcode payload via the public booking flow that is stored as the customer name and later executed when the Customer Cabinet block rendered by render_customer_dashboard() outputs the stored name into the content stream, where WordPress core's do_shortcode filter at priority 11 re-parses and runs it (CVSS 3.1 9.1, AV:N/AC:L/PR:N/UI:N). No authentication, user interaction, or special privilege is required to plant the payload, though practical impact is deployment-dependent: the site must expose LatePoint's public booking flow, the Customer Cabinet rendering path must be reachable, and exploitable shortcodes must be registered for the injected payload to have effect. At time of analysis no public exploit code has been identified.
Unauthenticated customer-record disclosure in the LatePoint appointment booking plugin for WordPress, affecting all versions up to and including 5.7.4, allows remote attackers to harvest the first name, last name, email address, phone number and notes of every customer in the database by enumerating UUID prefixes through the steps__load_step AJAX endpoint using the params[customer[uuid]] parameter. Exploitation is strictly gated on a non-default configuration: the plugin's 'Field used for authentication' setting must be set to 'Disable ability to login' (guest checkout mode), so sites using default login-based authentication are not exposed. No public exploit code was identified at time of analysis; the AC:H rating reflects the request-heavy prefix enumeration required, which rate limiting or a WAF may slow or detect but does not prevent on an unprotected site.
Sensitive information exposure in the LatePoint appointment-booking plugin for WordPress (all versions up to and including 5.7.3) allows an authenticated subscriber-level user to leak privileged booking data - administrator-only admin_notes, assigned agent internal contact details, transaction tokens, and payment request URLs - by storing a template placeholder such as {{customer_admin_notes}} in their own first_name field via the customer_cabinet__update route and then triggering the LatePoint password-reset/notification email flow, which expands the placeholder server-side and mails the result to the attacker's address. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, base 4.3) confirms network reachability with mandatory low-privilege authentication and only a limited confidentiality impact, with no effect on integrity or availability and no code execution or data modification; no public exploit identified at time of analysis, and exploitation depends on the site allowing self-registration or otherwise granting low-privilege accounts that can reach the customer cabinet update route.
Missing authorization in the LatePoint Appointment Booking plugin for WordPress (versions up to and including 5.7.2) allows unauthenticated attackers to create approved appointments against other customers' order items by sending a non-empty params[presets][order_item_id] to the publicly reachable steps__start and steps__load_step routes. The plugin's is_bundle_scheduling() discriminator is only an !empty(order_item_id) truthiness check, so supplying any value causes the booking flow to strip out the customer and payment steps and to skip ownership, bundle-membership, paid-status, and remaining-capacity validation. Successful requests leak the targeted customer's name, email address, and order code in the booking confirmation; exploitation is limited in practice by the need to know or guess a valid order item ID of a victim. No public exploit code or confirmed active exploitation was identified at time of analysis.
Authenticated attackers holding only Subscriber-level access can tamper with the personal records of arbitrary LatePoint customers on WordPress sites running the Appointment Booking & Reservation plugin through version 5.6.9. The process_step_customer() handler merges attacker-supplied POST data into an existing customer record while checking only is_user_logged_in(), so any logged-in account can rewrite another customer's first name, last name, email, phone, and notes; where the non-default contact_merge setting is 'phone', this escalates to overwriting the victim's email and enabling account takeover via password reset. Exploitation requires a valid low-privilege session (PR:L), which is trivial on sites with open registration, and there is no public exploit identified at time of analysis, though the EPSS-style risk is moderate rather than critical.
Unauthenticated remote attackers can enumerate and manipulate customer invoices in the WordPress plugin Appointment Booking Plugin - LatePoint | Calendar & Scheduling for WordPress through version 5.7.1, because the OsPaypalConnectController::create_order_for_transaction() handler is exposed as a public wp_ajax_nopriv_latepoint_route_call route and loads an OsInvoiceModel using a bare sequential integer invoice_id with no ownership or access-key check. An attacker who iterates invoice IDs can confirm the existence of invoices belonging to arbitrary customers and cause transaction-intent rows to be created against those invoices, and can overwrite the intent_key of any in-flight NEW-status transaction intent, breaking the Stripe/Razorpay checkout and webhook flows those customers are waiting on. No public exploit identified at time of analysis, and exploitation is limited in practice by the need to guess sequential IDs and by the fact that meaningful intent_key disruption requires a victim to be mid-checkout; the affected code path remains otherwise reachable without authentication and without user interaction.
Insecure Direct Object Reference in the LatePoint calendar booking plugin for WordPress (all versions up to and including 5.6.3) lets an authenticated LatePoint Agent-level user - or anyone with a higher role - read bookings and customer PII belonging to other agents and delete arbitrary bookings simply by supplying any booking ID, because the booking key is user-controlled and never checked against the caller's ownership. The CVSS vector (PR:L) confirms authentication is required, and the flaw is only reachable when an administrator has explicitly turned on the plugin's Abilities API toggles (latepoint_abilities_api plus latepoint_abilities_api_delete and/or latepoint_abilities_api_edit), which are not enabled by default and therefore substantially limit real-world exposure. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV); independent assessment rates this as a real but modestly-scoped, low-to-moderate priority issue affecting confidentiality and integrity within the agent population.
Stored Cross-Site Scripting in the LatePoint WordPress appointment booking plugin (all versions through 5.3.2) allows authenticated attackers with contributor-level access to inject persistent malicious scripts via the 'btn_wrapper_classes' attribute of the 'latepoint_resources' shortcode. The injected payload executes in any visitor's browser upon loading the affected page, enabling session hijacking, credential theft, or malicious redirects against site users. No public exploit code or active exploitation has been identified at time of analysis; however, the low privilege requirement expands the attacker pool on multi-contributor WordPress deployments.