CVE-2026-105198 LatePoint CVE debrief

Who should care

Defenders responsible for WordPress installations with the Appointment Booking Plugin, version prior to 5.7.3, should assess exposure and prioritize verification and remediation to prevent customer PII disclosure.

Why it matters

CVE-2026-105198 is a vulnerability in the Appointment Booking Plugin for WordPress that allows unauthenticated disclosure of customer PII via IDOR. Defenders should prioritize verifying exposure, restricting access to order-item identifiers, and monitoring for suspicious activity.

• Potential disclosure of customer personal identifiable information (PII)
• Increased risk of targeted attacks or phishing using disclosed customer data
• Reputation damage due to customer data exposure
• Potential regulatory compliance issues related to customer data protection

Technical summary

The Appointment Booking Plugin for WordPress contains an insecure direct object reference (IDOR) vulnerability in versions prior to 5.7.3. This allows an unauthenticated attacker to retrieve customer personal identifiable information (PII), including name, contact details, and order confirmation code, by supplying a sequential order-item ID. The vulnerability arises from inadequate verification of the caller owning the order referenced by an order-item identifier. Defenders should prioritize verifying exposure of Appointment Booking Plugin versions prior to 5.7.3 and assess the potential for customer PII disclosure.

Defensive priority

Defenders should prioritize verifying exposure of Appointment Booking Plugin versions prior to 5.7.3 and assess the potential for customer PII disclosure.

Recommended defensive actions

• Verify Appointment Booking Plugin version and update to 5.7.3 or later if necessary
• Restrict access to order-item identifiers and customer PII
• Monitor for suspicious activity related to order-item IDs and customer data
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

Evidence from the CVE Program and WPScan indicates that versions of Appointment Booking Plugin prior to 5.7.3 are affected by an IDOR vulnerability allowing unauthenticated customer PII disclosure. The vulnerability exists due to insufficient verification of order-item identifiers, enabling an attacker to retrieve customer PII, including names, contact details, and order confirmation codes, by supplying sequential order-item IDs. Defenders should verify exposure by checking plugin versions and assess potential customer PII disclosure.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.