CVE-2026-91050
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
The Appointment Booking Plugin – LatePoint for WordPress is vulnerable to Insecure Direct Object Reference / Missing Authorization in versions up to and including 5.7.2. Unauthenticated attackers can create approved appointments against other customers' order items and read their personal data.
Risk Assessment
The risk includes privacy breaches, unauthorized appointment creation, and access to personal data, potentially leading to fraud or GDPR violations.
Recommendation
Update the plugin immediately to a patched version. Also strengthen authorization checks and verify ownership of order items.
Other vulnerabilities in Appointment Booking Plugin – LatePoint
See all- CVE-2026-92966Critical
The Appointment Booking Plugin – LatePoint for WordPress up to version 5.7.0 is vulnerable to arbitrary shortcode execution. An unauthenticated attacker can plant a malicious shortcode during the booking flow, which gets executed when the Customer Cabinet block renders the stored name.
- CVE-2026-103380Medium
The Appointment Booking Plugin – LatePoint for WordPress is vulnerable to Sensitive Information Exposure in all versions up to 5.7.3 via the 'params[customer][first_name]' parameter. Authenticated attackers with subscriber-level access and above can extract privileged booking data including admin_notes, agent contact details, transaction tokens, and payment request URLs.
- CVE-2026-96662High
The Appointment Booking Plugin – LatePoint | Calendar & Scheduling plugin for WordPress is vulnerable to generic SQL Injection via the 'booking[service_id]' parameter in all versions up to and including 5.7.2 due to insufficient escaping and lack of query preparation. Unauthenticated attackers can append additional SQL queries to extract sensitive information from the database.
Original NVD description (English source)
The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference / Missing Authorization in versions up to, and including, 5.7.2. This is due to the publicly reachable steps__start and steps__load_step routes accepting a params[presets][order_item_id] value that is copied verbatim into the booking object without verifying that the referenced order item belongs to the current customer, is a bundle item, is paid, or has remaining capacity — the is_bundle_scheduling() bundle discriminator is a mere !empty(order_item_id) truthiness check, and the code flow explicitly removes the customer and payment steps when this is truthy (the source even carries a TODO acknowledging the missing validation). This makes it possible for unauthenticated attackers to create approved appointments against other customers' order items and to read those customers' names, email addresses, and order codes returned in the booking confirmation.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS