LatePoint <= 5.6.7 - Missing Authorization to Unauthenticated Booking Object Mass Assignment

Wordfence Intelligence   >   Vulnerability Database   >   LatePoint <= 5.6.7 - Missing Authorization to Unauthenticated Booking Object Mass Assignment
5.3
Missing Authorization
CVE CVE-2026-15250
CVSS 5.3 (Medium)
Publicly Published July 10, 2026
Last Updated August 21, 2026
Researcher Revanth Hari Narayana Matte

Description

The LatePoint plugin for WordPress is vulnerable to unauthorized access in versions up to, and including, 5.6.7. This is due to a missing capability check on a function. This makes it possible for unauthenticated attackers to perform an unauthorized action.

References

Share

Vulnerability Details for Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress

Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress

Software Type Plugin
Software Slug latepoint (view on wordpress.org)
Patched? Yes
Remediation Update to version 5.6.8, or a newer patched version
Affected Version
  • <= 5.6.7
Patched Version
  • 5.6.8

Recent vulnerabilities in Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress

Appointment Booking Plugin <= 5.7.2 - Unauthenticated Authentication Bypass to Customer Account Takeover via Insufficient Verification in create_wp_user_for_customer() username_exists Fallback
7.4
CVE-2026-100163
Oct 13, 2026
Researcher: OKISO
Appointment Booking Plugin <= 5.7.3 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'booking[id]' and 'cart[id]' Parameters
7.5
CVE-2026-103366
Oct 13, 2026
Researcher: churchill11
Appointment Booking Plugin <= 5.7.3 - Authenticated (Subscriber+) Sensitive Information Exposure in 'first_name' Parameter Template Re-expansion
4.3
CVE-2026-103380
Oct 13, 2026
Researcher: walid213
Appointment Booking Plugin <= 5.7.2 - Unauthenticated SQL Injection via 'booking[service_id]' Parameter
7.5
CVE-2026-96662
Oct 9, 2026
Researcher: zickzick2
Appointment Booking Plugin <= 5.7.3 - Authenticated (Custom+) Privilege Escalation to 'settings[default_wp_role_for_customer]' Parameter
8.8
CVE-2026-104766
Oct 9, 2026
Researcher: Wordfence PRISM
Appointment Booking Plugin <= 5.7.2 - Insecure Direct Object Reference to Authenticated (Subscriber+) Unauthorized Booking Creation and Sensitive Information Disclosure via 'params[presets][order_item_id]' Parameter
4.3
CVE-2026-91050
Oct 9, 2026
Researcher: Supakiad S. (m3ez)
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress < 5.6.9 - Authenticated (Custom Role+) Insecure Direct Object Reference
4.3
CVE-2026-105196
Oct 8, 2026
Researcher: Artus KG
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress < 5.7.3 - Unauthenticated Insecure Direct Object Reference
5.3
CVE-2026-105198
Oct 8, 2026
Researcher: Vũ Quang Huy
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress < 5.6.5 - Authenticated (Custom Role+) Insecure Direct Object Reference
4.3
CVE-2026-105197
Oct 8, 2026
Researcher: Muni Nitish Kumar Yaddala
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress <= 5.6.9 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Customer PII Modification
5.4
CVE-2026-17538
Oct 7, 2026
Researcher: owlmind
# Title CVE ID CVSS Researchers Date
1 Appointment Booking Plugin <= 5.7.2 - Unauthenticated Authentication Bypass to Customer Account Takeover via Insufficient Verification in create_wp_user_for_customer() username_exists Fallback CVE-2026-100163 7.4 OKISO October 13, 2026
2 Appointment Booking Plugin <= 5.7.3 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'booking[id]' and 'cart[id]' Parameters CVE-2026-103366 7.5 churchill11 October 13, 2026
3 Appointment Booking Plugin <= 5.7.3 - Authenticated (Subscriber+) Sensitive Information Exposure in 'first_name' Parameter Template Re-expansion CVE-2026-103380 4.3 walid213 October 13, 2026
4 Appointment Booking Plugin <= 5.7.2 - Unauthenticated SQL Injection via 'booking[service_id]' Parameter CVE-2026-96662 7.5 zickzick2 October 9, 2026
5 Appointment Booking Plugin <= 5.7.3 - Authenticated (Custom+) Privilege Escalation to 'settings[default_wp_role_for_customer]' Parameter CVE-2026-104766 8.8 Wordfence PRISM October 9, 2026
6 Appointment Booking Plugin <= 5.7.2 - Insecure Direct Object Reference to Authenticated (Subscriber+) Unauthorized Booking Creation and Sensitive Information Disclosure via 'params[presets][order_item_id]' Parameter CVE-2026-91050 4.3 Supakiad S. (m3ez) October 9, 2026
7 Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress < 5.6.9 - Authenticated (Custom Role+) Insecure Direct Object Reference CVE-2026-105196 4.3 Artus KG October 8, 2026
8 Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress < 5.7.3 - Unauthenticated Insecure Direct Object Reference CVE-2026-105198 5.3 Vũ Quang Huy October 8, 2026
9 Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress < 5.6.5 - Authenticated (Custom Role+) Insecure Direct Object Reference CVE-2026-105197 4.3 Muni Nitish Kumar Yaddala October 8, 2026
10 Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress <= 5.6.9 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Customer PII Modification CVE-2026-17538 5.4 owlmind October 7, 2026
View more vulnerabilities in this software package View more vulnerabilities

This record contains material that is subject to copyright.

Copyright 2012-2026 Defiant Inc.

License: Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. Read more.

Copyright 1999-2026 The MITRE Corporation

License: CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. Read more.

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation