Appointment Booking Plugin <= 5.7.4 - Authenticated (LatePoint Agent+) Insecure Direct Object Reference to Customer Information Disclosure
- ID
- WPSEC-2026-1165
- Plugin
- Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress (latepoint)
- Affected
- all versions before 5.7.5
- Remediation
- Update to 5.7.5 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-639
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-16
- Attack surface
- Appointment Booking Plugin on WPSec AttackSurface
- Fix released
- Published
Description
The LatePoint plugin for WordPress is vulnerable to Insecure Direct Object Reference via the customers inline_edit_form, mini_profile and query_for_booking_form actions in all versions up to, and including, 5.7.4, due to missing per-record permission checks on a user-controlled customer ID and a customer search that is not filtered to allowed records. This makes it possible for authenticated attackers with LatePoint agent access (or another backend role that has the customer__view capability but is limited to its own records) to view the details of any customer, such as name, email address, phone number and booking statistics, and to search across all customers.
References
- https://wpsec.com/vuln/WPSEC-2026-1165/
- https://plugins.svn.wordpress.org/latepoint/tags/5.7.5/
- https://wordpress.org/plugins/latepoint/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS