PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-111602 latepoint CVE debrief

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure. This vulnerability allows unauthenticated attackers to extract customer records by enumerating uuid prefixes via the unauthenticated steps__load_step AJAX endpoint when the plugin is configured with 'Field used for authentication' set to 'Disable ability to login' (guest checkout mode).

Vendor
latepoint
Product
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress
CVSS
LOW 3.7
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-17
Original CVE updated
2026-10-17
Advisory published
2026-10-17
Advisory updated
2026-10-17

Who should care

Defenders responsible for WordPress installations with the Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin should assess exposure and prioritize verification and potential updates.

Why it matters

CVE-2026-111602 is a Sensitive Information Exposure vulnerability in the Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress. Defenders should prioritize verifying the plugin version and configuration, and consider updating to a patched version if available.

  • Verify plugin version and configuration to determine if vulnerable
  • Potential extraction of sensitive customer information by unauthenticated attackers
  • Consider updating to a patched version if available

Technical summary

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.7.4 via the 'params (customer[uuid])' parameter. This makes it possible for unauthenticated attackers to extract the first name, last name, email address, phone number, and notes of every customer record in the database by enumerating uuid prefixes via the unauthenticated steps__load_step AJAX endpoint.

Defensive priority

Defenders should prioritize verifying the plugin version and configuration, and consider updating to a patched version if available.

Recommended defensive actions

  • Verify the plugin version and configuration to determine if vulnerable
  • Consider updating to a patched version if available
  • Monitor for potential exploitation attempts
  • Perform a thorough review of customer records for potential exposure
  • Implement additional monitoring for suspicious activity related to customer data
  • Review and update incident response plans to address potential data breaches
  • Conduct a thorough risk assessment to identify potential impacts on the organization

Evidence notes

The vulnerability was reported by [email protected] and is described in the CVE Program record and NIST NVD detail page. The CVE record was published on 2026-10-17T03:16:28.740Z and has not been modified since then. Evidence is limited to public CVE Program and NVD records. Defenders should verify plugin version and configuration to determine if vulnerable.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-111602 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-111602

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-111602 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-111602

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.