Executive brief
The LatePoint Appointment Booking plugin for WordPress, which manages customer appointments and payments, contains a security flaw that could allow an attacker to trick an administrator into performing unintended actions. By convincing a logged-in admin to click a malicious link, an attacker could change booking form settings or disconnect the site's payment gateway. This could lead to business disruption, loss of revenue, and unauthorized changes to how the site collects customer information.
Technical details
The LatePoint plugin (versions prior to 5.6.3) fails to validate CSRF nonces on several state-changing actions handled by its central request dispatcher (`latepoint_route_call`). An unauthenticated attacker can exploit this by crafting a malicious webpage that, when visited by a logged-in administrator, triggers unauthorized requests to `admin-ajax.php`. Successful exploitation allows the attacker to perform privileged actions such as overwriting booking-form configurations, deactivating customer data fields, or disconnecting integrated payment gateways like Stripe. The vulnerability exists because the dispatcher accepts requests even when the `_wpnonce` parameter is missing or invalid. The issue is resolved in version 5.6.3.
Affected products
- LatePoint LatePoint Appointment Booking Plugin < 5.6.3
Timeline
- 2026-06-25: disclosed: Initial public disclosure by WPScan
- 2026-06-25: patched: Fix released in version 5.6.3
- 2026-07-16: advisory: NVD publication date