Executive brief
LatePoint is a WordPress plugin that manages appointment scheduling and customer bookings. The plugin fails to validate customer identifiers when customer authentication is disabled (guest checkout enabled), allowing unauthenticated attackers to enumerate all customer records and expose personally identifiable information including names, emails, and phone numbers by simply iterating through customer IDs.
Technical details
The vulnerability is an Insecure Direct Object Reference (IDOR) in the set_customer_object function within the steps_controller component. The plugin fails to properly validate or authorize access to customer records based on a user-controlled customer[id] parameter. An unauthenticated attacker can exploit this by making requests with sequential or enumerated customer IDs to retrieve customer objects containing PII. The vulnerability is only exploitable when the WordPress site has guest checkout enabled (customer authentication disabled). No authentication or special privileges are required to trigger the vulnerability; it is network-accessible and requires only the ability to submit HTTP requests with different customer ID values.
Affected products
- LatePoint LatePoint up to and including 5.6.9
Timeline
- 2026-09-18: disclosed