# CVE-2026-13471: LatePoint Calendar Booking insecure direct object reference

Source: https://junglewise.ai/threats/cve-2026-13471-latepoint-calendar-booking-insecure-direct-object-reference  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-18. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-13471 · Severity: medium · CVSS 4.3 · Published 2026-09-18

LatePoint is a WordPress plugin that manages calendar bookings and customer appointments. The plugin fails to properly validate user permissions when accessing booking records, allowing authenticated agents to view bookings and sensitive customer data (names, emails, phone numbers, notes) belonging to other agents, and to delete any booking by guessing its ID. This exposure occurs only when administrators have enabled optional API features in plugin settings.

Technologies: [LatePoint – Calendar Booking Plugin for Appointments and Events](https://junglewise.ai/threats/technologies/latepoint). Vendors: [LatePoint](https://junglewise.ai/threats/vendors/latepoint).

## Quick answers

**Is CVE-2026-13471 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-13471 being exploited in the wild.

**How severe is CVE-2026-13471?** Medium severity, with a CVSS score of 4.3, published 18 September 2026.

**Which products and versions are affected?** LatePoint – Calendar Booking Plugin for Appointments and Events up to and including 5.6.3.

**Is there a fix for CVE-2026-13471?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-13471 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-13471?** Check whether you run LatePoint – Calendar Booking Plugin for Appointments and Events at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an Insecure Direct Object Reference (IDOR) in the LatePointAbilityDeleteBooking::execute method, affecting versions up to 5.6.3. The flaw stems from missing validation of user-controlled booking IDs, allowing attackers with LatePoint Agent-level access or higher to enumerate and manipulate arbitrary bookings. An authenticated attacker can read booking details and PII, or delete bookings, by supplying any valid booking ID. Exploitation requires that administrators have enabled the Abilities API toggles (latepoint_abilities_api, latepoint_abilities_api_delete, and/or latepoint_abilities_api_edit) in plugin settings. Patch availability was not indicated in the advisory.

## Affected products

- LatePoint LatePoint – Calendar Booking Plugin for Appointments and Events up to and including 5.6.3

## Timeline

- 2026-09-18: disclosed

## References

- [https://plugins.trac.wordpress.org/browser/latepoint/tags/5.4.2/lib/abilities/abstract-ability.php](https://plugins.trac.wordpress.org/browser/latepoint/tags/5.4.2/lib/abilities/abstract-ability.php)
- [https://plugins.trac.wordpress.org/browser/latepoint/tags/5.4.2/lib/abilities/bookings/abstract-booking-ability.php](https://plugins.trac.wordpress.org/browser/latepoint/tags/5.4.2/lib/abilities/bookings/abstract-booking-ability.php)

## Related threats

- [LatePoint WordPress Plugin CSRF in change_status function](https://junglewise.ai/threats/cve-2026-9719-latepoint-wordpress-plugin-csrf-in-change-status-function)