Quick answers
- Is CVE-2026-15250 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-15250 being exploited in the wild.
- How severe is CVE-2026-15250?
- Informational severity, with a CVSS score of 5.3, published 30 July 2026.
- Which products and versions are affected?
- LatePoint before 5.6.8.
- Is there a fix for CVE-2026-15250?
- A patch was published on 2026-07-30: Reported as fixed in 5.6.8 in NVD record Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-15250 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-15250?
- Check whether you run LatePoint at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A mass assignment vulnerability exists in the LatePoint plugin's public booking funnel via the 'latepoint_route_call' AJAX action. The plugin fails to restrict which fields of the booking object can be set by a visitor during the multi-step booking process. By injecting a 'booking[status]=approved' parameter into the POST request, an unauthenticated attacker can override the default 'pending' status. While the plugin still validates availability for dates and services, it does not prevent the modification of administrative fields like 'status', effectively bypassing the intended manual approval workflow. This issue is resolved in version 5.6.8.
Affected products
- LatePoint LatePoint before 5.6.8
Timeline
- 2026-07-10: disclosed
- 2026-07-10: advisory
- 2026-07-30: patched: Reported as fixed in 5.6.8 in NVD record