CVE-2026-13471 latepoint CVE debrief

Who should care

Defenders managing WordPress installations with the LatePoint plugin, particularly those with LatePoint Agent-level access and above, should assess exposure and verify the Abilities API toggles are not enabled to minimize potential risks. This includes operators, platform administrators, vulnerability management teams, and security teams responsible for maintaining the security posture of affected systems.

Why it matters

CVE-2026-13471 allows unauthorized access to bookings and customer data in the LatePoint plugin for WordPress. Defenders should verify the Abilities API toggles are not enabled and restrict LatePoint Agent access to minimize potential exposure.

• Verify Abilities API toggles are not enabled to prevent unauthorized access.
• Restrict LatePoint Agent access to minimize potential exposure.
• Monitor for unusual booking or customer data access patterns.

Technical summary

The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.6.3 via the LatePointAbilityDeleteBooking::execute due to missing validation on a user controlled key. This makes it possible for attackers, with LatePoint Agent-level access and above, to read bookings and customer PII assigned to other LatePoint agents, and delete arbitrary bookings by supplying any booking ID. This vulnerability is only exploitable when an administrator has enabled the Abilities API toggles (latepoint_abilities_api, latepoint_abilities_api_delete, and/or latepoint_abilities_api_edit) in the plugin settings.

Defensive priority

Defenders should prioritize verifying the Abilities API toggles are not enabled and restrict LatePoint Agent access to minimize potential exposure.

Recommended defensive actions

• Verify the Abilities API toggles are not enabled in the plugin settings.
• Restrict LatePoint Agent access to minimize potential exposure.
• Monitor for unusual booking or customer data access patterns.
• Consider updating to a patched version if available.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The vulnerability is confirmed in plugin versions up to 5.6.3. Official CVE and NVD records provide details. Defenders should verify the Abilities API toggles are not enabled and restrict LatePoint Agent access. Evidence is limited to public CVE and NVD records, which may not provide a comprehensive view of affected versions or specific remediation steps. Further verification tasks are recommended to ensure accurate exposure assessment.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.