Appointment Booking Plugin – LatePoint vulnerabilities

The Appointment Booking Plugin – LatePoint for WordPress up to version 5.7.0 is vulnerable to arbitrary shortcode execution. An unauthenticated attacker can plant a malicious shortcode during the booking flow, which gets executed when the Customer Cabinet block renders the stored name.

The Appointment Booking Plugin – LatePoint for WordPress is vulnerable to Sensitive Information Exposure in all versions up to 5.7.3 via the 'params[customer][first_name]' parameter. Authenticated attackers with subscriber-level access and above can extract privileged booking data including admin_notes, agent contact details, transaction tokens, and payment request URLs.

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling plugin for WordPress is vulnerable to generic SQL Injection via the 'booking[service_id]' parameter in all versions up to and including 5.7.2 due to insufficient escaping and lack of query preparation. Unauthenticated attackers can append additional SQL queries to extract sensitive information from the database.

The Appointment Booking Plugin – LatePoint for WordPress is vulnerable to Insecure Direct Object Reference / Missing Authorization in versions up to and including 5.7.2. Unauthenticated attackers can create approved appointments against other customers' order items and read their personal data.