Vulnerabilities / LatePoint / WPSEC-2026-2335
LatePoint <= 5.7.6 - Authenticated (Agent+) Insecure Direct Object Reference to Transaction Modification via 'transactions[id]' Parameter
Medium 4.3
CWE-639Fixed in 5.7.7
- ID
- WPSEC-2026-2335
- Plugin
- Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress (latepoint)
- Affected
- all versions before 5.7.7
- Remediation
- Update to 5.7.7 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-639
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-11-03
- Attack surface
- LatePoint on WPSec AttackSurface
- Fix released
- Published
Description
The LatePoint plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.7.6, due to the order save handler loading a transaction by its client-supplied 'id' without verifying that it belongs to the order being saved. This makes it possible for authenticated attackers, with LatePoint Agent-level access and above, to reassign and modify transaction records belonging to orders outside their allowed records.
References
- https://wpsec.com/vuln/WPSEC-2026-2335/
- https://plugins.svn.wordpress.org/latepoint/tags/5.7.7/
- https://wordpress.org/plugins/latepoint/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS