CVE-2026-94432 latepoint CVE debrief

Who should care

Defenders responsible for WordPress installations using the Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress, especially those with customer payment processes, should assess exposure and potential impact.

Why it matters

CVE-2026-94432 is a medium-severity vulnerability in the Appointment Booking Plugin for WordPress, allowing unauthenticated attackers to manipulate transaction intents and potentially disrupt payment processes. Defenders should verify exposure, assess impact on customer payment processes, and prioritize patching or mitigating this vulnerability.

• Unauthenticated attackers can enumerate invoices belonging to arbitrary customers.
• Attackers can create unauthorized transaction-intent rows linked to another customer's data.
• Attackers can overwrite the intent_key of any in-flight NEW-status transaction intent, potentially breaking payment webhooks for affected customers.

Technical summary

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 5.7.1. The OsPaypalConnectController::create_order_for_transaction() action allows loading an OsInvoiceModel by a sequential integer 'invoice_id' without access-key/UUID or ownership check, enabling unauthenticated attackers to enumerate invoices, create unauthorized transaction-intent rows, and overwrite intent_keys, potentially disrupting payment processes for affected customers.

Defensive priority

Defenders should prioritize verifying exposure and assessing potential impact on customer payment processes.

Recommended defensive actions

• Verify the version of the Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin and update to a patched version if necessary.
• Assess exposure by checking if the plugin is used and if customer payment processes are potentially impacted.
• Implement additional monitoring to detect potential unauthorized transaction-intent rows or intent_key overwrites.
• Review and update incident response plans to address potential payment webhook disruptions.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The vulnerability is caused by the OsPaypalConnectController::create_order_for_transaction() action, which allows loading an OsInvoiceModel by a sequential integer 'invoice_id' without access-key/UUID or ownership check.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.