Executive brief
LatePoint is a popular WordPress plugin used for managing appointment bookings and schedules. A security flaw allows an attacker to trick a logged-in customer into unintentionally canceling their own appointments by clicking a malicious link. This could lead to service disruptions, loss of revenue for the business, and a poor customer experience.
Technical details
The LatePoint plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) due to missing nonce verification on the request_cancellation() function within the customer cabinet controller. An unauthenticated attacker can exploit this by crafting a malicious request and tricking a logged-in customer into executing it (e.g., via a phishing link). Successful exploitation allows the attacker to cancel the victim's existing bookings without their consent. The issue is addressed in version 5.4.0 by implementing proper security tokens (nonces) to validate requests.
Affected products
- LatePoint LatePoint up to and including 5.3.2
Timeline
- 2026-05-14: disclosed
- 2026-05-14: advisory