Is CVE-2026-5365 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-5365 being exploited in the wild.

How severe is CVE-2026-5365?

Medium severity, with a CVSS score of 4.3, published 14 May 2026.

Which products and versions are affected?

LatePoint up to and including 5.3.2.

Is there a fix for CVE-2026-5365?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-5365 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-5365?

Check whether you run LatePoint at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-5365: LatePoint WordPress plugin CSRF in request_cancellation

CVE-2026-5365 · Severity: medium · CVSS 4.3 · Published 2026-05-14

LatePoint is a popular WordPress plugin used for managing appointment bookings and schedules. A security flaw allows an attacker to trick a logged-in customer into unintentionally canceling their own appointments by clicking a malicious link. This could lead to service disruptions, loss of revenue for the business, and a poor customer experience.

Technologies: LatePoint. Vendors: LatePoint.

Quick answers

Is CVE-2026-5365 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-5365 being exploited in the wild.
How severe is CVE-2026-5365?: Medium severity, with a CVSS score of 4.3, published 14 May 2026.
Which products and versions are affected?: LatePoint up to and including 5.3.2.
Is there a fix for CVE-2026-5365?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-5365 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-5365?: Check whether you run LatePoint at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The LatePoint plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) due to missing nonce verification on the request_cancellation() function within the customer cabinet controller. An unauthenticated attacker can exploit this by crafting a malicious request and tricking a logged-in customer into executing it (e.g., via a phishing link). Successful exploitation allows the attacker to cancel the victim's existing bookings without their consent. The issue is addressed in version 5.4.0 by implementing proper security tokens (nonces) to validate requests.

Affected products

LatePoint LatePoint up to and including 5.3.2

Timeline

2026-05-14: disclosed
2026-05-14: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.