Appointment Booking Plugin <= 5.7.3 - Unauthenticated Insecure Direct Object Reference to Cart Item Modification via 'active_cart_item[id]'

ID

WPSEC-2026-0451

Plugin

Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress (latepoint)

Affected

from 5.7.0 before 5.7.4

Remediation

Update to 5.7.4 or later.

CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness

CWE-639

Usage

Plugin Medium · Affected versions Low among sites WPSec scans, 2026-10-06

Attack surface

Appointment Booking Plugin on WPSec AttackSurface

Fix released

2026-10-05

Published

2026-10-06

Description

The LatePoint plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions 5.7.0 up to, and including, 5.7.3. This is due to the booking form accepting a client-supplied 'active_cart_item[id]' value for any existing cart item without verifying that it belongs to the visitor's own cart, after which the event registration step saves that item into the visitor's cart. This makes it possible for unauthenticated attackers to take over and overwrite cart items belonging to other visitors, removing them from those visitors' carts.

References

• https://wpsec.com/vuln/WPSEC-2026-0451/
• https://plugins.svn.wordpress.org/latepoint/tags/5.7.4/
• https://wordpress.org/plugins/latepoint/

Published by WPSec. Provided as is, without warranty. Corrections: contact us.

This advisory as JSON or Markdown · All advisories: JSON, RSS