Quick answers
- Is CVE-2026-5356 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-5356 being exploited in the wild.
- How severe is CVE-2026-5356?
- High severity, with a CVSS score of 7.5, published 8 July 2026.
- Which products and versions are affected?
- LatePoint 0 - 5.4.0.
- Is there a fix for CVE-2026-5356?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-5356 attacked?
- It is attacked over the network, in a network appliance.
- Am I affected by CVE-2026-5356?
- Check whether you run LatePoint at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The LatePoint plugin for WordPress is vulnerable to Improper Input Validation in versions up to and including 5.4.0. The root cause is located within the Stripe Connect payment processor component, which accepts a client-supplied PaymentIntent ID without sufficient server-side verification. An unauthenticated attacker can exploit this by providing a PaymentIntent token from a previously successful transaction to validate a new booking. This allows the attacker to bypass the intended payment amount and secure bookings for arbitrary or zero-cost values. A patch has been identified in the plugin's development changeset.
Affected products
- LatePoint LatePoint – Calendar Booking Plugin for Appointments and Events 0 - 5.4.0
Timeline
- 2026-07-08: advisory: NVD and Wordfence published the vulnerability details.
- 2026-07-08: disclosed