{
 "id": "WPSEC-2026-1165",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1165/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1165/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1165/index.md",
 "title": "Appointment Booking Plugin <= 5.7.4 - Authenticated (LatePoint Agent+) Insecure Direct Object Reference to Customer Information Disclosure",
 "description": "The LatePoint plugin for WordPress is vulnerable to Insecure Direct Object Reference via the customers inline_edit_form, mini_profile and query_for_booking_form actions in all versions up to, and including, 5.7.4, due to missing per-record permission checks on a user-controlled customer ID and a customer search that is not filtered to allowed records. This makes it possible for authenticated attackers with LatePoint agent access (or another backend role that has the customer__view capability but is limited to its own records) to view the details of any customer, such as name, email address, phone number and booking statistics, and to search across all customers.",
 "plugin": {
  "slug": "latepoint",
  "name": "Appointment Booking Plugin",
  "full_name": "Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress",
  "wordpress_org": "https://wordpress.org/plugins/latepoint/",
  "advisories_url": "https://wpsec.com/vuln/plugin/latepoint/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/latepoint"
 },
 "type": "IDOR",
 "cwe": [
  "CWE-639"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 4.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "5.7.5",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 5.7.5"
  ]
 },
 "introduced_in": null,
 "fixed_in": "5.7.5",
 "remediation": "Update to 5.7.5 or later.",
 "fix_released": "2026-10-16T05:37:10+00:00",
 "published": "2026-10-17T05:42:11+00:00",
 "updated": "2026-10-16T09:50:12.424314+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1165/",
  "https://plugins.svn.wordpress.org/latepoint/tags/5.7.5/",
  "https://wordpress.org/plugins/latepoint/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/latepoint",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-10-17"
 }
}