Is CVE-2026-12657 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-12657 being exploited in the wild.

How severe is CVE-2026-12657?

Medium severity, with a CVSS score of 5.3, published 2 July 2026.

Which products and versions are affected?

LatePoint up to, and including, 5.6.2.

Is there a fix for CVE-2026-12657?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-12657 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-12657?

Check whether you run LatePoint at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-12657: LatePoint WordPress Plugin IDOR in service_id parameter

CVE-2026-12657 · Severity: medium · CVSS 5.3 · Published 2026-07-02

A vulnerability in the LatePoint booking plugin for WordPress allows unauthorized users to schedule appointments for services that should be restricted to administrators or agents. This could lead to the exhaustion of appointment slots and the creation of unauthorized bookings for private or internal-only services. The issue affects all versions of the plugin up to 5.6.2.

Technologies: LatePoint. Vendors: LatePoint.

Quick answers

Is CVE-2026-12657 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-12657 being exploited in the wild.
How severe is CVE-2026-12657?: Medium severity, with a CVSS score of 5.3, published 2 July 2026.
Which products and versions are affected?: LatePoint up to, and including, 5.6.2.
Is there a fix for CVE-2026-12657?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-12657 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-12657?: Check whether you run LatePoint at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The LatePoint plugin for WordPress is vulnerable to an Insecure Direct Object Reference (IDOR) via the 'service_id' parameter. The vulnerability stems from missing validation on user-controlled keys within the 'steps__load_step' and 'steps__start' functions, specifically via the 'params[booking][service_id]' and 'presets[selected_service]' parameters. An unauthenticated attacker can exploit this to bypass access controls and create approved bookings for services intended only for admins or agents. This can result in unauthorized resource consumption and scheduling of restricted services. The issue is present in all versions up to and including 5.6.2.

Affected products

LatePoint LatePoint – Calendar Booking Plugin for Appointments and Events up to, and including, 5.6.2

Timeline

2026-07-02: disclosed: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.