# Appointment Booking Plugin <= 5.7.3 - Unauthenticated Insecure Direct Object Reference to Cart Item Modification via 'active_cart_item[id]'

- **ID:** WPSEC-2026-0451
- **Plugin:** Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress (`latepoint`), https://wordpress.org/plugins/latepoint/
- **Affected versions:** from 5.7.0 before 5.7.4
- **Fixed in:** 5.7.4 (Update to 5.7.4 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-639
- **Usage among sites WPSec scans:** plugin Medium, affected versions Low (as of 2026-10-06)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/latepoint
- **Fix released:** 2026-10-05
- **Published:** 2026-10-06
- **URL:** https://wpsec.com/vuln/WPSEC-2026-0451/

## Description

The LatePoint plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions 5.7.0 up to, and including, 5.7.3. This is due to the booking form accepting a client-supplied 'active_cart_item[id]' value for any existing cart item without verifying that it belongs to the visitor's own cart, after which the event registration step saves that item into the visitor's cart. This makes it possible for unauthenticated attackers to take over and overwrite cart items belonging to other visitors, removing them from those visitors' carts.

## References

- https://wpsec.com/vuln/WPSEC-2026-0451/
- https://plugins.svn.wordpress.org/latepoint/tags/5.7.4/
- https://wordpress.org/plugins/latepoint/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-0451/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.