{
 "id": "WPSEC-2026-1164",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1164/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1164/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1164/index.md",
 "title": "Appointment Booking Plugin <= 5.7.4 - Unauthenticated Payment Bypass via 'payment_portion' Parameter",
 "description": "The LatePoint plugin for WordPress is vulnerable to a payment bypass via the 'cart[payment_portion]' parameter in all versions up to, and including, 5.7.4, due to the cart's payment_portion attribute being mass-assignable from the public booking form without checking whether a deposit is actually due. This makes it possible for unauthenticated attackers to submit a 'deposit' payment portion on a cart that has no deposit. The charge amount is then zero, payment processing is skipped, and the order is still created at its full price, so attackers can book paid services without paying upfront.",
 "plugin": {
  "slug": "latepoint",
  "name": "Appointment Booking Plugin",
  "full_name": "Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress",
  "wordpress_org": "https://wordpress.org/plugins/latepoint/",
  "advisories_url": "https://wpsec.com/vuln/plugin/latepoint/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/latepoint"
 },
 "type": "BYPASS",
 "cwe": [
  "CWE-840"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "5.7.5",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 5.7.5"
  ]
 },
 "introduced_in": null,
 "fixed_in": "5.7.5",
 "remediation": "Update to 5.7.5 or later.",
 "fix_released": "2026-10-16T05:37:10+00:00",
 "published": "2026-10-17T05:42:11+00:00",
 "updated": "2026-10-16T09:50:12.424314+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1164/",
  "https://plugins.svn.wordpress.org/latepoint/tags/5.7.5/",
  "https://wordpress.org/plugins/latepoint/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/latepoint",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-10-17"
 }
}