CVE-2026-96662 latepoint CVE debrief

Who should care

WordPress administrators and defenders responsible for securing WordPress installations should assess the potential impact of this vulnerability on their database security and take necessary actions to protect sensitive information.

Why it matters

This vulnerability allows unauthenticated attackers to potentially extract sensitive information from the database, disrupting database operations and increasing the risk of data breaches. WordPress administrators and defenders should verify the presence of this vulnerability in their installations and assess the potential impact on their database security.

• Potential extraction of sensitive information from the database.
• Possible disruption of database operations.
• Increased risk of data breaches.
• Need for verification of vulnerability presence and impact.

Technical summary

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to unauthenticated SQL Injection via the 'booking[service_id]' parameter in versions up to and including 5.7.2. This vulnerability allows unauthenticated attackers to append additional SQL queries to existing queries, potentially leading to sensitive information extraction from the database.

Defensive priority

Defenders should prioritize verifying the presence of this vulnerability in their WordPress installations and assessing the potential impact on their database security.

Recommended defensive actions

• Verify the version of the Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin and upgrade to a patched version if necessary.
• Assess the potential impact of this vulnerability on your database security and implement measures to protect sensitive information.
• Monitor your WordPress installation for suspicious activity related to this vulnerability.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The vulnerability is caused by insufficient escaping of the user-supplied parameter and lack of sufficient preparation on the existing SQL query. This information is based on the CVE Program record and the source item from cve_program_cvelist_v5.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.