# Appointment Booking Plugin <= 5.7.4 - Authenticated (LatePoint Agent+) Insecure Direct Object Reference to Customer Information Disclosure

- **ID:** WPSEC-2026-1165
- **Plugin:** Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress (`latepoint`), https://wordpress.org/plugins/latepoint/
- **Affected versions:** all versions before 5.7.5
- **Fixed in:** 5.7.5 (Update to 5.7.5 or later.)
- **Severity:** Medium 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-639
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-10-17)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/latepoint
- **Fix released:** 2026-10-16
- **Published:** 2026-10-17
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1165/

## Description

The LatePoint plugin for WordPress is vulnerable to Insecure Direct Object Reference via the customers inline_edit_form, mini_profile and query_for_booking_form actions in all versions up to, and including, 5.7.4, due to missing per-record permission checks on a user-controlled customer ID and a customer search that is not filtered to allowed records. This makes it possible for authenticated attackers with LatePoint agent access (or another backend role that has the customer__view capability but is limited to its own records) to view the details of any customer, such as name, email address, phone number and booking statistics, and to search across all customers.

## References

- https://wpsec.com/vuln/WPSEC-2026-1165/
- https://plugins.svn.wordpress.org/latepoint/tags/5.7.5/
- https://wordpress.org/plugins/latepoint/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1165/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.