Executive brief
The LatePoint Appointment Booking plugin for WordPress, which manages service scheduling and customer appointments, contains a flaw in its booking process. An unauthorized visitor can manipulate hidden data fields during the booking flow to automatically approve their own appointments, bypassing the site owner's required approval workflow. This could lead to unauthorized service bookings and disruption of business operations.
Technical details
A mass assignment vulnerability exists in the LatePoint plugin's public booking funnel via the 'latepoint_route_call' AJAX action. The plugin fails to restrict which fields of the booking object can be set by a visitor during the multi-step booking process. By injecting a 'booking[status]=approved' parameter into the POST request, an unauthenticated attacker can override the default 'pending' status. While the plugin still validates availability for dates and services, it does not prevent the modification of administrative fields like 'status', effectively bypassing the intended manual approval workflow. This issue is resolved in version 5.6.8.
Affected products
- LatePoint LatePoint before 5.6.8
Timeline
- 2026-07-10: disclosed
- 2026-07-10: advisory
- 2026-07-30: patched: Reported as fixed in 5.6.8 in NVD record