CVE-2026-13471 latepoint CVE debrief

Who should care

WordPress administrators and users with LatePoint Agent-level access or above should assess exposure and verify the Abilities API toggles are not enabled. Defenders should prioritize restricting access to sensitive features and ensuring proper validation of user-controlled keys.

Why it matters

CVE-2026-13471 allows unauthorized access to bookings and customer data in the LatePoint plugin for WordPress. Defenders should verify exposure, restrict access, and monitor for suspicious activity.

• Verify Abilities API toggles are not enabled to prevent unauthorized access.
• Restrict LatePoint Agent access to sensitive features to limit potential damage.
• Monitor for suspicious booking deletion or access attempts to detect potential exploitation.

Technical summary

The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Insecure Direct Object Reference due to missing validation on a user-controlled key in the LatePointAbilityDeleteBooking::execute function. This allows attackers with LatePoint Agent-level access and above to read bookings and customer PII assigned to other LatePoint agents and delete arbitrary bookings when specific Abilities API toggles are enabled.

Defensive priority

Defenders should prioritize verifying the Abilities API toggles are not enabled and restrict LatePoint Agent access to sensitive features.

Recommended defensive actions

• Verify the Abilities API toggles (latepoint_abilities_api, latepoint_abilities_api_delete, and/or latepoint_abilities_api_edit) are not enabled in the plugin settings.
• Restrict LatePoint Agent access to sensitive features and ensure proper validation of user-controlled keys.
• Monitor for suspicious booking deletion or access attempts.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The vulnerability is confirmed in plugin versions up to 5.6.3. Official source references include CVE Program and NVD records, as well as code references from WordPress plugin repository. Evidence is limited to public CVE Program and NVD records. Defenders should verify plugin version and Abilities API toggles, and review code changes in plugin updates.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.