Executive brief
The LatePoint plugin for WordPress, which manages appointment and event bookings, contains a security flaw in its payment processing system. This vulnerability allows unauthorized individuals to bypass standard payment requirements by reusing old transaction IDs. As a result, attackers can book services or events for arbitrary amounts, potentially leading to significant financial loss and disruption of business operations.
Technical details
The LatePoint plugin for WordPress is vulnerable to Improper Input Validation in versions up to and including 5.4.0. The root cause is located within the Stripe Connect payment processor component, which accepts a client-supplied PaymentIntent ID without sufficient server-side verification. An unauthenticated attacker can exploit this by providing a PaymentIntent token from a previously successful transaction to validate a new booking. This allows the attacker to bypass the intended payment amount and secure bookings for arbitrary or zero-cost values. A patch has been identified in the plugin's development changeset.
Affected products
- LatePoint LatePoint – Calendar Booking Plugin for Appointments and Events 0 - 5.4.0
Timeline
- 2026-07-08: advisory: NVD and Wordfence published the vulnerability details.
- 2026-07-08: disclosed