Executive brief
The LatePoint plugin for WordPress, which manages appointment and event bookings, contains a security flaw that allows unauthorized users to modify customer information. By submitting a booking form with an existing customer's email address, an attacker can change names, phone numbers, and notes associated with that account. This risk is present when the plugin is configured to allow guest bookings without requiring user authentication.
Technical details
A missing authorization vulnerability (CWE-862) exists in the LatePoint WordPress plugin due to insufficient validation in the process_step_customer() function. When guest bookings are enabled (is_customer_auth_disabled() returns true), an unauthenticated attacker can reach a code path that updates customer metadata based on the provided email address. By submitting a booking form with a known customer's email, an attacker can overwrite PII including first name, last name, phone number, and notes for any existing record, including those associated with administrators. The vulnerability is present in all versions up to and including 5.6.1.
Affected products
- LatePoint LatePoint – Calendar Booking Plugin for Appointments and Events up to, and including, 5.6.1
Timeline
- 2026-07-03: disclosed: CVE published to NVD dataset
References
- https://plugins.trac.wordpress.org/browser/latepoint/tags/5.3.2/lib/controllers/steps_controller.php
- https://plugins.trac.wordpress.org/browser/latepoint/tags/5.3.2/lib/helpers/steps_helper.php
- https://plugins.trac.wordpress.org/browser/latepoint/tags/5.3.2/lib/helpers/steps_helper.php
- https://plugins.trac.wordpress.org/browser/latepoint/tags/5.3.2/lib/helpers/steps_helper.php
- https://plugins.trac.wordpress.org/browser/latepoint/tags/5.6.1/lib/controllers/steps_controller.php
- https://plugins.trac.wordpress.org/browser/latepoint/tags/5.6.1/lib/helpers/steps_helper.php
- https://plugins.trac.wordpress.org/browser/latepoint/tags/5.6.1/lib/helpers/steps_helper.php