{
 "id": "WPSEC-2026-2477",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2477/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2477/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2477/index.md",
 "title": "LatePoint <= 5.7.7 - Unauthenticated Insecure Direct Object Reference to Invoice Disclosure via 'key' Parameter",
 "description": "The LatePoint plugin for WordPress is vulnerable to Insecure Direct Object Reference via the 'key' parameter of the public invoice view, payment form and payment summary actions in all versions up to, and including, 5.7.7, due to the model query builder treating the literal strings 'IS NULL' and 'IS NOT NULL' supplied in user input as SQL null-check operators instead of binding them as values. This makes it possible for unauthenticated attackers to bypass the invoice access key check and view an invoice, which may contain customer and order details, without knowing its secret access key.",
 "plugin": {
  "slug": "latepoint",
  "name": "LatePoint",
  "full_name": "Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress",
  "wordpress_org": "https://wordpress.org/plugins/latepoint/",
  "advisories_url": "https://wpsec.com/vuln/plugin/latepoint/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/latepoint"
 },
 "type": "IDOR",
 "cwe": [
  "CWE-639"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "5.7.8",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 5.7.8"
  ]
 },
 "introduced_in": null,
 "fixed_in": "5.7.8",
 "remediation": "Update to 5.7.8 or later.",
 "fix_released": "2026-11-03T11:47:23+00:00",
 "published": "2026-11-04T14:58:24+00:00",
 "updated": "2026-11-04T13:57:46.037264+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2477/",
  "https://plugins.svn.wordpress.org/latepoint/tags/5.7.8/",
  "https://wordpress.org/plugins/latepoint/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/latepoint",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-11-04"
 }
}