Latepoint
Monthly
LatePoint WordPress plugin through 5.7.4 allows unauthenticated remote attackers who know a target customer's registered email address or phone number to bypass OTP authentication by racing the attempts counter and brute-forcing the 6-digit code, potentially taking over that customer's account, bookings, and personal data. Exploitation requires the site to use LatePoint's OTP/passwordless login flow and the attacker to win a concurrency race while guessing the code; no public exploit identified at time of analysis.
Unauthenticated information disclosure in the LatePoint appointment booking and scheduling plugin for WordPress (versions up to and including 5.7.3) lets any remote attacker read other customers' appointment records and pending cart contents by supplying sequential booking[id] and cart[id] values to the public steps__reload_booking_form_summary_panel and steps__start routes, which are reachable without login through wp_ajax_nopriv_latepoint_route_call. No ownership check is applied to those identifiers, so enumeration is trivial and requires no authentication, no user interaction and no special configuration beyond having the plugin active with live booking or cart data; the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, 7.5) confirms remote unauthenticated exploitation with confidentiality-only impact, and the readiness of sequential integer keys makes the practical barrier to exploitation very low. No public exploit code has been identified at time of analysis, the flaw is not listed in CISA KEV, and EPSS data was not available in the supplied intelligence; the assessment is that this is a genuine, easily reproducible read-only disclosure rather than an inflated high-severity score.
Customer account takeover in the Appointment Booking Plugin - LatePoint | Calendar & Scheduling for WordPress through 5.7.2 is possible on sites that enable the 'Use WordPress users as customers' option: an authenticated Subscriber-level attacker whose own user_login equals a victim customer's email address causes their WordPress user ID to be linked into that victim's LatePoint customer row, exposing the victim's bookings, services, agents and calendar data and overwriting the victim's email address the next time the victim logs in. Exploitation is tightly conditional - it requires the opt-in WordPress-user integration, a Subscriber account (commonly obtainable when open registration is enabled), and prior knowledge of the target's email address, so the attack is per-victim and targeted rather than mass-exploitable; no public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS score was provided in the source data. The flaw has been assigned CVSS 7.4 with high confidentiality and integrity impact but no availability impact, and a fix appears to have shipped in the 5.7.3 release.
Unauthenticated SQL injection in the LatePoint WordPress plugin (versions up to and including 5.7.2) allows remote attackers to append arbitrary SQL queries via the 'booking[service_id]' parameter, enabling extraction of sensitive data from the database. The vulnerability is easily exploitable (CVSS 7.5) with no authentication or user interaction required, and affects the plugin's core booking functionality. No public exploit code or active exploitation has been identified at time of analysis, but the flaw poses a significant risk due to its low complexity and high confidentiality impact.
Privilege escalation in the LatePoint appointment booking plugin for WordPress (all versions up to and including 5.7.3) lets an authenticated LatePoint user who holds the settings__edit capability overwrite the default_wp_role_for_customer setting with 'administrator', so that any LatePoint customer account self-registered afterwards is created with full WordPress administrator rights. The flaw is entirely server-side - the role restriction exists only in the UI dropdown and is never validated when the setting is persisted - but it is gated by two real prerequisites: a WordPress administrator must first delegate settings__edit to an agent or custom role, and a new customer registration must occur after the malicious value is saved for the escalation to materialize. No public exploit code or confirmed active exploitation was identified at time of analysis, and the assessed vector (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) treats this as a genuine high-impact issue that nonetheless sits below its 8.8 headline score in practical priority.
Unauthenticated arbitrary shortcode execution in LatePoint (Appointment Booking Plugin - Calendar & Scheduling for WordPress) affects all versions up to and including 5.7.0, allowing an attacker to plant a shortcode payload via the public booking flow that is stored as the customer name and later executed when the Customer Cabinet block rendered by render_customer_dashboard() outputs the stored name into the content stream, where WordPress core's do_shortcode filter at priority 11 re-parses and runs it (CVSS 3.1 9.1, AV:N/AC:L/PR:N/UI:N). No authentication, user interaction, or special privilege is required to plant the payload, though practical impact is deployment-dependent: the site must expose LatePoint's public booking flow, the Customer Cabinet rendering path must be reachable, and exploitable shortcodes must be registered for the injected payload to have effect. At time of analysis no public exploit code has been identified.
Blind SQL injection in the LatePoint WordPress appointment-booking plugin (versions up to and including 5.6.3) lets remote unauthenticated attackers inject crafted SQL through improperly neutralized input (CWE-89), enabling extraction of database contents via boolean/time-based inference. Reported by Patchstack and rated CVSS 9.3 with a network vector requiring no privileges or user interaction; the changed scope reflects access to the shared WordPress/MySQL database beyond the plugin's own boundary. No public exploit is identified at time of analysis and it is not listed in CISA KEV.
Payment amount manipulation in the LatePoint Calendar Booking plugin for WordPress (versions up to and including 5.4.0) lets unauthenticated attackers finalize bookings while paying an arbitrary amount. The Stripe Connect payment processor trusts a client-supplied PaymentIntent ID, so an attacker can replay a previously succeeded PaymentIntent token to satisfy the payment check. No public exploit identified at time of analysis, and the flaw is not in CISA KEV.
Privilege escalation to Administrator in the LatePoint booking plugin for WordPress (versions up to and including 5.6.3) lets an authenticated Agent-level user hijack any WordPress account by abusing an Insecure Direct Object Reference in OsOrdersController::create_or_update(). By supplying an arbitrary order[customer_id], an attacker overwrites the email of any LatePoint customer - including one tied to a WordPress Administrator - and then logs in as that user because OsAuthHelper::authorize_customer() never checks the linked account's role. Reported by Wordfence and rated CVSS 8.8; no public exploit identified at time of analysis and it is not on CISA KEV, though the root-cause code paths are pinpointed in public plugin source.
Privilege escalation in the LatePoint Calendar Booking plugin for WordPress (versions up to and including 5.5.1) allows an authenticated user with Agent-level access or higher to chain three independent flaws and overwrite a WordPress Administrator's password without invoking any Administrator-only API. Wordfence-reported flaw with no public exploit identified at time of analysis, though source code locations of all three vulnerable code paths are referenced in the disclosure.
Privilege escalation in the LatePoint WordPress plugin versions 5.5.1 and earlier allows authenticated users holding low-privileged contributor accounts to elevate to higher-privileged roles, according to a Patchstack advisory. CVSS 3.1 scores this 7.5 (High) with full confidentiality, integrity, and availability impact, though high attack complexity and required low privileges constrain trivial exploitation. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Stored Cross-Site Scripting in LatePoint Calendar Booking Plugin for WordPress allows unauthenticated remote attackers to inject malicious JavaScript via the 'first_name' parameter in appointment booking forms, affecting all versions through 5.5.0. The injected scripts persist in the database and execute whenever administrators or other users view booking records, potentially enabling session hijacking, privilege escalation, or further attacks against site administrators. The CVSS vector indicates network-accessible exploitation with no authentication required and changed scope, enabling attacks beyond the vulnerable component. EPSS score not provided; no confirmation of active exploitation (not in CISA KEV) or public exploit code at time of analysis.
Stored cross-site scripting (XSS) in LatePoint WordPress booking plugin (versions ≤5.5.0) allows unauthenticated attackers to inject malicious scripts via the 'booking_form_page_url' parameter that execute when administrators view activity logs. The vulnerability exploits a design flaw where the latepoint_order_intent_created action hook writes unsanitized input to the database before Stripe Connect validation occurs, meaning no functional payment integration is required for exploitation. Wordfence reported this issue with source code references demonstrating the flawed input handling in activities_controller.php and activities_helper.php. CVSS 7.2 with scope change (S:C) reflects potential for attackers to pivot from stored XSS to administrative session hijacking.
Privilege escalation in the LatePoint booking plugin for WordPress (versions ≤ 5.4.1) lets an authenticated user holding the built-in latepoint_agent role hijack any WordPress administrator account. The connect-customer-to-wp-user ability's execute() method performs no check that the target WP user ID is a privileged account, so an agent can bind a controlled LatePoint customer record to an admin's account and then trigger the standard customer password-reset flow to seize it. CVSS is 8.8; EPSS is very low (0.05%, 15th percentile) and there is no public exploit identified at time of analysis, but the technical impact is total site takeover.
Price tampering in the LatePoint WordPress booking plugin before 5.7.5 lets a remote unauthenticated visitor manipulate the client-supplied value that sets the booking charge, so the amount due can be resolved to zero and the visitor walks away with a confirmed appointment and a recorded order without paying. Any WordPress site running a pre-5.7.5 LatePoint installation that sells chargeable appointments through the plugin's own checkout flow is exposed; no account, special role, or non-default configuration is needed, only the ability to submit a booking (CVSS 3.1: AV:N/AC:L/PR:N/UI:N, 5.3, limited to integrity impact). Publicly available exploit code exists, and the issue is documented in the WPScan vulnerability database; the practical exposure is a direct revenue-loss and booking-fraud vector rather than a data breach. No CISA KEV entry was provided, so active exploitation is not confirmed.
Unauthenticated customer-record disclosure in the LatePoint appointment booking plugin for WordPress, affecting all versions up to and including 5.7.4, allows remote attackers to harvest the first name, last name, email address, phone number and notes of every customer in the database by enumerating UUID prefixes through the steps__load_step AJAX endpoint using the params[customer[uuid]] parameter. Exploitation is strictly gated on a non-default configuration: the plugin's 'Field used for authentication' setting must be set to 'Disable ability to login' (guest checkout mode), so sites using default login-based authentication are not exposed. No public exploit code was identified at time of analysis; the AC:H rating reflects the request-heavy prefix enumeration required, which rate limiting or a WAF may slow or detect but does not prevent on an unprotected site.
Sensitive information exposure in the LatePoint appointment-booking plugin for WordPress (all versions up to and including 5.7.3) allows an authenticated subscriber-level user to leak privileged booking data - administrator-only admin_notes, assigned agent internal contact details, transaction tokens, and payment request URLs - by storing a template placeholder such as {{customer_admin_notes}} in their own first_name field via the customer_cabinet__update route and then triggering the LatePoint password-reset/notification email flow, which expands the placeholder server-side and mails the result to the attacker's address. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, base 4.3) confirms network reachability with mandatory low-privilege authentication and only a limited confidentiality impact, with no effect on integrity or availability and no code execution or data modification; no public exploit identified at time of analysis, and exploitation depends on the site allowing self-registration or otherwise granting low-privilege accounts that can reach the customer cabinet update route.
Missing authorization in the LatePoint Appointment Booking plugin for WordPress (versions up to and including 5.7.2) allows unauthenticated attackers to create approved appointments against other customers' order items by sending a non-empty params[presets][order_item_id] to the publicly reachable steps__start and steps__load_step routes. The plugin's is_bundle_scheduling() discriminator is only an !empty(order_item_id) truthiness check, so supplying any value causes the booking flow to strip out the customer and payment steps and to skip ownership, bundle-membership, paid-status, and remaining-capacity validation. Successful requests leak the targeted customer's name, email address, and order code in the booking confirmation; exploitation is limited in practice by the need to know or guess a valid order item ID of a victim. No public exploit code or confirmed active exploitation was identified at time of analysis.
Authenticated attackers holding only Subscriber-level access can tamper with the personal records of arbitrary LatePoint customers on WordPress sites running the Appointment Booking & Reservation plugin through version 5.6.9. The process_step_customer() handler merges attacker-supplied POST data into an existing customer record while checking only is_user_logged_in(), so any logged-in account can rewrite another customer's first name, last name, email, phone, and notes; where the non-default contact_merge setting is 'phone', this escalates to overwriting the victim's email and enabling account takeover via password reset. Exploitation requires a valid low-privilege session (PR:L), which is trivial on sites with open registration, and there is no public exploit identified at time of analysis, though the EPSS-style risk is moderate rather than critical.
Unauthenticated remote attackers can enumerate and manipulate customer invoices in the WordPress plugin Appointment Booking Plugin - LatePoint | Calendar & Scheduling for WordPress through version 5.7.1, because the OsPaypalConnectController::create_order_for_transaction() handler is exposed as a public wp_ajax_nopriv_latepoint_route_call route and loads an OsInvoiceModel using a bare sequential integer invoice_id with no ownership or access-key check. An attacker who iterates invoice IDs can confirm the existence of invoices belonging to arbitrary customers and cause transaction-intent rows to be created against those invoices, and can overwrite the intent_key of any in-flight NEW-status transaction intent, breaking the Stripe/Razorpay checkout and webhook flows those customers are waiting on. No public exploit identified at time of analysis, and exploitation is limited in practice by the need to guess sequential IDs and by the fact that meaningful intent_key disruption requires a victim to be mid-checkout; the affected code path remains otherwise reachable without authentication and without user interaction.
Insecure Direct Object Reference in the LatePoint calendar booking plugin for WordPress (all versions up to and including 5.6.3) lets an authenticated LatePoint Agent-level user - or anyone with a higher role - read bookings and customer PII belonging to other agents and delete arbitrary bookings simply by supplying any booking ID, because the booking key is user-controlled and never checked against the caller's ownership. The CVSS vector (PR:L) confirms authentication is required, and the flaw is only reachable when an administrator has explicitly turned on the plugin's Abilities API toggles (latepoint_abilities_api plus latepoint_abilities_api_delete and/or latepoint_abilities_api_edit), which are not enabled by default and therefore substantially limit real-world exposure. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV); independent assessment rates this as a real but modestly-scoped, low-to-moderate priority issue affecting confidentiality and integrity within the agent population.
LatePoint, a WordPress appointment booking and scheduling plugin, allows remote attackers to enumerate and read arbitrary customer records through the plugin's step-handling endpoint because the customer[id] parameter is trusted without any ownership or identity check (CWE-639). All versions up to and including 5.6.9 are affected, and the exposure is decisive only on sites configured with customer authentication disabled (guest checkout enabled), where the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N applies - unauthenticated, no user interaction, and trivially automatable by iterating integer IDs. The result is disclosure of personally identifiable information including first name, last name, email address and phone number; there is no write, code execution or denial-of-service impact, and no public exploit code has been identified at time of analysis. Sites that require customers to log in before booking are not reachable through the unauthenticated path, which is the primary limiting factor on real-world exposure.
Stored Cross-Site Scripting in the LatePoint WordPress appointment booking plugin (all versions through 5.3.2) allows authenticated attackers with contributor-level access to inject persistent malicious scripts via the 'btn_wrapper_classes' attribute of the 'latepoint_resources' shortcode. The injected payload executes in any visitor's browser upon loading the affected page, enabling session hijacking, credential theft, or malicious redirects against site users. No public exploit code or active exploitation has been identified at time of analysis; however, the low privilege requirement expands the attacker pool on multi-contributor WordPress deployments.
Authorization bypass in the LatePoint Calendar Booking Plugin for WordPress (all versions through 5.6.1) permits unauthenticated attackers to overwrite customer PII - first name, last name, phone number, and notes - on any existing customer record, including those associated with administrator accounts, by submitting the public booking form with a known or guessed target email address. The attack is gated by a specific non-default plugin configuration (guest bookings enabled), meaningfully narrowing the realistic exposure surface. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Insecure Direct Object Reference in LatePoint Calendar Booking Plugin for WordPress (all versions ≤ 5.6.2) enables unauthenticated attackers to create approved bookings against services explicitly restricted to administrators and agents. The bypass operates through two publicly accessible booking step endpoints that accept a user-controlled service identifier without validating the requester's authorization to book that service. No public exploit code or CISA KEV listing has been identified, but the CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms trivially exploitable, zero-barrier network access against default plugin configurations that utilize service-level access restrictions.
Cross-Site Request Forgery in the LatePoint WordPress booking plugin (all versions ≤ 5.3.2) allows unauthenticated attackers to cancel a logged-in customer's appointments without consent by delivering a forged HTTP request. The root cause is missing nonce verification in the request_cancellation() function within the customer cabinet controller. EPSS is negligible at 0.02% (7th percentile), SSVC classifies exploitation as none, and no public exploit code or active exploitation has been identified at time of analysis.
LatePoint plugin for WordPress versions up to 5.5.0 allows unauthenticated attackers to perform account takeover of non-super-admin WordPress users by exploiting a weak password recovery mechanism in the guest booking flow. The vulnerability chains two flaws: the plugin's save_connected_wordpress_user() function updates WordPress user emails via wp_update_user() without ownership verification, and the guest booking flow permits email overwrites through phone-based customer merging without authentication. Attackers can overwrite a target user's email address and then trigger WordPress's standard password reset to gain full account access. No public exploit code has been identified at time of analysis, but exploitation requires only that the plugin be configured with WordPress user integration enabled, phone-based contact merging enabled, and customer authentication disabled.
Stored cross-site scripting in LatePoint calendar booking plugin for WordPress versions up to 5.5.0 allows authenticated customers to inject malicious scripts via unsanitized profile fields (first name, last name, phone, notes) that execute in administrators' browsers when notification templates are previewed. Exploitation requires customer-level access and admin interaction to preview a notification template, but achieves code execution in a high-privilege context (administrator or agent browser session) with scope change from single user to multiple users.
LatePoint WordPress plugin versions up to 5.3.2 expose a public, unauthenticated endpoint (OsStripeConnectController::create_payment_intent_for_transaction) that allows sequential enumeration of invoice IDs and unauthorized creation of transaction intent records containing sensitive financial data, customer identifiers, and Stripe payment secrets. Unauthenticated remote attackers can exploit this Insecure Direct Object Reference (IDOR) vulnerability to leak confidential payment information and Stripe Connect tokens without authentication or user interaction. No active exploitation has been confirmed at the time of analysis.
Stored Cross-Site Scripting in LatePoint Calendar Booking Plugin for WordPress up to version 5.3.0 allows authenticated contributors and above to inject arbitrary JavaScript via the 'button_caption' parameter in the [latepoint_resources] shortcode when 'items' is set to 'bundles'. The injected scripts execute for all users viewing the affected page. No public exploit code or active exploitation has been identified, though the vulnerability requires only contributor-level access and automatic exploitation is feasible.
An authorization bypass vulnerability exists in LatePoint versions up to and including 5.2.6 that allows attackers to exploit incorrectly configured access control security levels through user-controlled key manipulation. This Insecure Direct Object Reference (IDOR) vulnerability enables attackers without proper authentication or authorization to access resources they should not have permission to view or modify. The vulnerability affects the LatePoint WordPress plugin and has been documented by Patchstack with proof-of-concept details available, making it a practical exploitation risk for unpatched installations.
Cross-Site Request Forgery (CSRF) vulnerability in Latepoint LatePoint allows Cross Site Request Forgery.9.91. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The LatePoint plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 5.0.12. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The LatePoint plugin for WordPress is vulnerable to Arbitrary User Password Change via SQL Injection in versions up to, and including, 5.0.11. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Latepoint LatePoint allows Stored XSS.9.91. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The LatePoint Plugin plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a missing capability check on the 'start_or_use_session_for_customer' function. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
LatePoint WordPress plugin through 5.7.4 allows unauthenticated remote attackers who know a target customer's registered email address or phone number to bypass OTP authentication by racing the attempts counter and brute-forcing the 6-digit code, potentially taking over that customer's account, bookings, and personal data. Exploitation requires the site to use LatePoint's OTP/passwordless login flow and the attacker to win a concurrency race while guessing the code; no public exploit identified at time of analysis.
Unauthenticated information disclosure in the LatePoint appointment booking and scheduling plugin for WordPress (versions up to and including 5.7.3) lets any remote attacker read other customers' appointment records and pending cart contents by supplying sequential booking[id] and cart[id] values to the public steps__reload_booking_form_summary_panel and steps__start routes, which are reachable without login through wp_ajax_nopriv_latepoint_route_call. No ownership check is applied to those identifiers, so enumeration is trivial and requires no authentication, no user interaction and no special configuration beyond having the plugin active with live booking or cart data; the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, 7.5) confirms remote unauthenticated exploitation with confidentiality-only impact, and the readiness of sequential integer keys makes the practical barrier to exploitation very low. No public exploit code has been identified at time of analysis, the flaw is not listed in CISA KEV, and EPSS data was not available in the supplied intelligence; the assessment is that this is a genuine, easily reproducible read-only disclosure rather than an inflated high-severity score.
Customer account takeover in the Appointment Booking Plugin - LatePoint | Calendar & Scheduling for WordPress through 5.7.2 is possible on sites that enable the 'Use WordPress users as customers' option: an authenticated Subscriber-level attacker whose own user_login equals a victim customer's email address causes their WordPress user ID to be linked into that victim's LatePoint customer row, exposing the victim's bookings, services, agents and calendar data and overwriting the victim's email address the next time the victim logs in. Exploitation is tightly conditional - it requires the opt-in WordPress-user integration, a Subscriber account (commonly obtainable when open registration is enabled), and prior knowledge of the target's email address, so the attack is per-victim and targeted rather than mass-exploitable; no public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS score was provided in the source data. The flaw has been assigned CVSS 7.4 with high confidentiality and integrity impact but no availability impact, and a fix appears to have shipped in the 5.7.3 release.
Unauthenticated SQL injection in the LatePoint WordPress plugin (versions up to and including 5.7.2) allows remote attackers to append arbitrary SQL queries via the 'booking[service_id]' parameter, enabling extraction of sensitive data from the database. The vulnerability is easily exploitable (CVSS 7.5) with no authentication or user interaction required, and affects the plugin's core booking functionality. No public exploit code or active exploitation has been identified at time of analysis, but the flaw poses a significant risk due to its low complexity and high confidentiality impact.
Privilege escalation in the LatePoint appointment booking plugin for WordPress (all versions up to and including 5.7.3) lets an authenticated LatePoint user who holds the settings__edit capability overwrite the default_wp_role_for_customer setting with 'administrator', so that any LatePoint customer account self-registered afterwards is created with full WordPress administrator rights. The flaw is entirely server-side - the role restriction exists only in the UI dropdown and is never validated when the setting is persisted - but it is gated by two real prerequisites: a WordPress administrator must first delegate settings__edit to an agent or custom role, and a new customer registration must occur after the malicious value is saved for the escalation to materialize. No public exploit code or confirmed active exploitation was identified at time of analysis, and the assessed vector (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) treats this as a genuine high-impact issue that nonetheless sits below its 8.8 headline score in practical priority.
Unauthenticated arbitrary shortcode execution in LatePoint (Appointment Booking Plugin - Calendar & Scheduling for WordPress) affects all versions up to and including 5.7.0, allowing an attacker to plant a shortcode payload via the public booking flow that is stored as the customer name and later executed when the Customer Cabinet block rendered by render_customer_dashboard() outputs the stored name into the content stream, where WordPress core's do_shortcode filter at priority 11 re-parses and runs it (CVSS 3.1 9.1, AV:N/AC:L/PR:N/UI:N). No authentication, user interaction, or special privilege is required to plant the payload, though practical impact is deployment-dependent: the site must expose LatePoint's public booking flow, the Customer Cabinet rendering path must be reachable, and exploitable shortcodes must be registered for the injected payload to have effect. At time of analysis no public exploit code has been identified.
Blind SQL injection in the LatePoint WordPress appointment-booking plugin (versions up to and including 5.6.3) lets remote unauthenticated attackers inject crafted SQL through improperly neutralized input (CWE-89), enabling extraction of database contents via boolean/time-based inference. Reported by Patchstack and rated CVSS 9.3 with a network vector requiring no privileges or user interaction; the changed scope reflects access to the shared WordPress/MySQL database beyond the plugin's own boundary. No public exploit is identified at time of analysis and it is not listed in CISA KEV.
Payment amount manipulation in the LatePoint Calendar Booking plugin for WordPress (versions up to and including 5.4.0) lets unauthenticated attackers finalize bookings while paying an arbitrary amount. The Stripe Connect payment processor trusts a client-supplied PaymentIntent ID, so an attacker can replay a previously succeeded PaymentIntent token to satisfy the payment check. No public exploit identified at time of analysis, and the flaw is not in CISA KEV.
Privilege escalation to Administrator in the LatePoint booking plugin for WordPress (versions up to and including 5.6.3) lets an authenticated Agent-level user hijack any WordPress account by abusing an Insecure Direct Object Reference in OsOrdersController::create_or_update(). By supplying an arbitrary order[customer_id], an attacker overwrites the email of any LatePoint customer - including one tied to a WordPress Administrator - and then logs in as that user because OsAuthHelper::authorize_customer() never checks the linked account's role. Reported by Wordfence and rated CVSS 8.8; no public exploit identified at time of analysis and it is not on CISA KEV, though the root-cause code paths are pinpointed in public plugin source.
Privilege escalation in the LatePoint Calendar Booking plugin for WordPress (versions up to and including 5.5.1) allows an authenticated user with Agent-level access or higher to chain three independent flaws and overwrite a WordPress Administrator's password without invoking any Administrator-only API. Wordfence-reported flaw with no public exploit identified at time of analysis, though source code locations of all three vulnerable code paths are referenced in the disclosure.
Privilege escalation in the LatePoint WordPress plugin versions 5.5.1 and earlier allows authenticated users holding low-privileged contributor accounts to elevate to higher-privileged roles, according to a Patchstack advisory. CVSS 3.1 scores this 7.5 (High) with full confidentiality, integrity, and availability impact, though high attack complexity and required low privileges constrain trivial exploitation. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Stored Cross-Site Scripting in LatePoint Calendar Booking Plugin for WordPress allows unauthenticated remote attackers to inject malicious JavaScript via the 'first_name' parameter in appointment booking forms, affecting all versions through 5.5.0. The injected scripts persist in the database and execute whenever administrators or other users view booking records, potentially enabling session hijacking, privilege escalation, or further attacks against site administrators. The CVSS vector indicates network-accessible exploitation with no authentication required and changed scope, enabling attacks beyond the vulnerable component. EPSS score not provided; no confirmation of active exploitation (not in CISA KEV) or public exploit code at time of analysis.
Stored cross-site scripting (XSS) in LatePoint WordPress booking plugin (versions ≤5.5.0) allows unauthenticated attackers to inject malicious scripts via the 'booking_form_page_url' parameter that execute when administrators view activity logs. The vulnerability exploits a design flaw where the latepoint_order_intent_created action hook writes unsanitized input to the database before Stripe Connect validation occurs, meaning no functional payment integration is required for exploitation. Wordfence reported this issue with source code references demonstrating the flawed input handling in activities_controller.php and activities_helper.php. CVSS 7.2 with scope change (S:C) reflects potential for attackers to pivot from stored XSS to administrative session hijacking.
Privilege escalation in the LatePoint booking plugin for WordPress (versions ≤ 5.4.1) lets an authenticated user holding the built-in latepoint_agent role hijack any WordPress administrator account. The connect-customer-to-wp-user ability's execute() method performs no check that the target WP user ID is a privileged account, so an agent can bind a controlled LatePoint customer record to an admin's account and then trigger the standard customer password-reset flow to seize it. CVSS is 8.8; EPSS is very low (0.05%, 15th percentile) and there is no public exploit identified at time of analysis, but the technical impact is total site takeover.
Price tampering in the LatePoint WordPress booking plugin before 5.7.5 lets a remote unauthenticated visitor manipulate the client-supplied value that sets the booking charge, so the amount due can be resolved to zero and the visitor walks away with a confirmed appointment and a recorded order without paying. Any WordPress site running a pre-5.7.5 LatePoint installation that sells chargeable appointments through the plugin's own checkout flow is exposed; no account, special role, or non-default configuration is needed, only the ability to submit a booking (CVSS 3.1: AV:N/AC:L/PR:N/UI:N, 5.3, limited to integrity impact). Publicly available exploit code exists, and the issue is documented in the WPScan vulnerability database; the practical exposure is a direct revenue-loss and booking-fraud vector rather than a data breach. No CISA KEV entry was provided, so active exploitation is not confirmed.
Unauthenticated customer-record disclosure in the LatePoint appointment booking plugin for WordPress, affecting all versions up to and including 5.7.4, allows remote attackers to harvest the first name, last name, email address, phone number and notes of every customer in the database by enumerating UUID prefixes through the steps__load_step AJAX endpoint using the params[customer[uuid]] parameter. Exploitation is strictly gated on a non-default configuration: the plugin's 'Field used for authentication' setting must be set to 'Disable ability to login' (guest checkout mode), so sites using default login-based authentication are not exposed. No public exploit code was identified at time of analysis; the AC:H rating reflects the request-heavy prefix enumeration required, which rate limiting or a WAF may slow or detect but does not prevent on an unprotected site.
Sensitive information exposure in the LatePoint appointment-booking plugin for WordPress (all versions up to and including 5.7.3) allows an authenticated subscriber-level user to leak privileged booking data - administrator-only admin_notes, assigned agent internal contact details, transaction tokens, and payment request URLs - by storing a template placeholder such as {{customer_admin_notes}} in their own first_name field via the customer_cabinet__update route and then triggering the LatePoint password-reset/notification email flow, which expands the placeholder server-side and mails the result to the attacker's address. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, base 4.3) confirms network reachability with mandatory low-privilege authentication and only a limited confidentiality impact, with no effect on integrity or availability and no code execution or data modification; no public exploit identified at time of analysis, and exploitation depends on the site allowing self-registration or otherwise granting low-privilege accounts that can reach the customer cabinet update route.
Missing authorization in the LatePoint Appointment Booking plugin for WordPress (versions up to and including 5.7.2) allows unauthenticated attackers to create approved appointments against other customers' order items by sending a non-empty params[presets][order_item_id] to the publicly reachable steps__start and steps__load_step routes. The plugin's is_bundle_scheduling() discriminator is only an !empty(order_item_id) truthiness check, so supplying any value causes the booking flow to strip out the customer and payment steps and to skip ownership, bundle-membership, paid-status, and remaining-capacity validation. Successful requests leak the targeted customer's name, email address, and order code in the booking confirmation; exploitation is limited in practice by the need to know or guess a valid order item ID of a victim. No public exploit code or confirmed active exploitation was identified at time of analysis.
Authenticated attackers holding only Subscriber-level access can tamper with the personal records of arbitrary LatePoint customers on WordPress sites running the Appointment Booking & Reservation plugin through version 5.6.9. The process_step_customer() handler merges attacker-supplied POST data into an existing customer record while checking only is_user_logged_in(), so any logged-in account can rewrite another customer's first name, last name, email, phone, and notes; where the non-default contact_merge setting is 'phone', this escalates to overwriting the victim's email and enabling account takeover via password reset. Exploitation requires a valid low-privilege session (PR:L), which is trivial on sites with open registration, and there is no public exploit identified at time of analysis, though the EPSS-style risk is moderate rather than critical.
Unauthenticated remote attackers can enumerate and manipulate customer invoices in the WordPress plugin Appointment Booking Plugin - LatePoint | Calendar & Scheduling for WordPress through version 5.7.1, because the OsPaypalConnectController::create_order_for_transaction() handler is exposed as a public wp_ajax_nopriv_latepoint_route_call route and loads an OsInvoiceModel using a bare sequential integer invoice_id with no ownership or access-key check. An attacker who iterates invoice IDs can confirm the existence of invoices belonging to arbitrary customers and cause transaction-intent rows to be created against those invoices, and can overwrite the intent_key of any in-flight NEW-status transaction intent, breaking the Stripe/Razorpay checkout and webhook flows those customers are waiting on. No public exploit identified at time of analysis, and exploitation is limited in practice by the need to guess sequential IDs and by the fact that meaningful intent_key disruption requires a victim to be mid-checkout; the affected code path remains otherwise reachable without authentication and without user interaction.
Insecure Direct Object Reference in the LatePoint calendar booking plugin for WordPress (all versions up to and including 5.6.3) lets an authenticated LatePoint Agent-level user - or anyone with a higher role - read bookings and customer PII belonging to other agents and delete arbitrary bookings simply by supplying any booking ID, because the booking key is user-controlled and never checked against the caller's ownership. The CVSS vector (PR:L) confirms authentication is required, and the flaw is only reachable when an administrator has explicitly turned on the plugin's Abilities API toggles (latepoint_abilities_api plus latepoint_abilities_api_delete and/or latepoint_abilities_api_edit), which are not enabled by default and therefore substantially limit real-world exposure. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV); independent assessment rates this as a real but modestly-scoped, low-to-moderate priority issue affecting confidentiality and integrity within the agent population.
LatePoint, a WordPress appointment booking and scheduling plugin, allows remote attackers to enumerate and read arbitrary customer records through the plugin's step-handling endpoint because the customer[id] parameter is trusted without any ownership or identity check (CWE-639). All versions up to and including 5.6.9 are affected, and the exposure is decisive only on sites configured with customer authentication disabled (guest checkout enabled), where the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N applies - unauthenticated, no user interaction, and trivially automatable by iterating integer IDs. The result is disclosure of personally identifiable information including first name, last name, email address and phone number; there is no write, code execution or denial-of-service impact, and no public exploit code has been identified at time of analysis. Sites that require customers to log in before booking are not reachable through the unauthenticated path, which is the primary limiting factor on real-world exposure.
Stored Cross-Site Scripting in the LatePoint WordPress appointment booking plugin (all versions through 5.3.2) allows authenticated attackers with contributor-level access to inject persistent malicious scripts via the 'btn_wrapper_classes' attribute of the 'latepoint_resources' shortcode. The injected payload executes in any visitor's browser upon loading the affected page, enabling session hijacking, credential theft, or malicious redirects against site users. No public exploit code or active exploitation has been identified at time of analysis; however, the low privilege requirement expands the attacker pool on multi-contributor WordPress deployments.
Authorization bypass in the LatePoint Calendar Booking Plugin for WordPress (all versions through 5.6.1) permits unauthenticated attackers to overwrite customer PII - first name, last name, phone number, and notes - on any existing customer record, including those associated with administrator accounts, by submitting the public booking form with a known or guessed target email address. The attack is gated by a specific non-default plugin configuration (guest bookings enabled), meaningfully narrowing the realistic exposure surface. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Insecure Direct Object Reference in LatePoint Calendar Booking Plugin for WordPress (all versions ≤ 5.6.2) enables unauthenticated attackers to create approved bookings against services explicitly restricted to administrators and agents. The bypass operates through two publicly accessible booking step endpoints that accept a user-controlled service identifier without validating the requester's authorization to book that service. No public exploit code or CISA KEV listing has been identified, but the CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms trivially exploitable, zero-barrier network access against default plugin configurations that utilize service-level access restrictions.
Cross-Site Request Forgery in the LatePoint WordPress booking plugin (all versions ≤ 5.3.2) allows unauthenticated attackers to cancel a logged-in customer's appointments without consent by delivering a forged HTTP request. The root cause is missing nonce verification in the request_cancellation() function within the customer cabinet controller. EPSS is negligible at 0.02% (7th percentile), SSVC classifies exploitation as none, and no public exploit code or active exploitation has been identified at time of analysis.
LatePoint plugin for WordPress versions up to 5.5.0 allows unauthenticated attackers to perform account takeover of non-super-admin WordPress users by exploiting a weak password recovery mechanism in the guest booking flow. The vulnerability chains two flaws: the plugin's save_connected_wordpress_user() function updates WordPress user emails via wp_update_user() without ownership verification, and the guest booking flow permits email overwrites through phone-based customer merging without authentication. Attackers can overwrite a target user's email address and then trigger WordPress's standard password reset to gain full account access. No public exploit code has been identified at time of analysis, but exploitation requires only that the plugin be configured with WordPress user integration enabled, phone-based contact merging enabled, and customer authentication disabled.
Stored cross-site scripting in LatePoint calendar booking plugin for WordPress versions up to 5.5.0 allows authenticated customers to inject malicious scripts via unsanitized profile fields (first name, last name, phone, notes) that execute in administrators' browsers when notification templates are previewed. Exploitation requires customer-level access and admin interaction to preview a notification template, but achieves code execution in a high-privilege context (administrator or agent browser session) with scope change from single user to multiple users.
LatePoint WordPress plugin versions up to 5.3.2 expose a public, unauthenticated endpoint (OsStripeConnectController::create_payment_intent_for_transaction) that allows sequential enumeration of invoice IDs and unauthorized creation of transaction intent records containing sensitive financial data, customer identifiers, and Stripe payment secrets. Unauthenticated remote attackers can exploit this Insecure Direct Object Reference (IDOR) vulnerability to leak confidential payment information and Stripe Connect tokens without authentication or user interaction. No active exploitation has been confirmed at the time of analysis.
Stored Cross-Site Scripting in LatePoint Calendar Booking Plugin for WordPress up to version 5.3.0 allows authenticated contributors and above to inject arbitrary JavaScript via the 'button_caption' parameter in the [latepoint_resources] shortcode when 'items' is set to 'bundles'. The injected scripts execute for all users viewing the affected page. No public exploit code or active exploitation has been identified, though the vulnerability requires only contributor-level access and automatic exploitation is feasible.
An authorization bypass vulnerability exists in LatePoint versions up to and including 5.2.6 that allows attackers to exploit incorrectly configured access control security levels through user-controlled key manipulation. This Insecure Direct Object Reference (IDOR) vulnerability enables attackers without proper authentication or authorization to access resources they should not have permission to view or modify. The vulnerability affects the LatePoint WordPress plugin and has been documented by Patchstack with proof-of-concept details available, making it a practical exploitation risk for unpatched installations.
Cross-Site Request Forgery (CSRF) vulnerability in Latepoint LatePoint allows Cross Site Request Forgery.9.91. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The LatePoint plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 5.0.12. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The LatePoint plugin for WordPress is vulnerable to Arbitrary User Password Change via SQL Injection in versions up to, and including, 5.0.11. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Latepoint LatePoint allows Stored XSS.9.91. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The LatePoint Plugin plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a missing capability check on the 'start_or_use_session_for_customer' function. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.