PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-9719 latepoint CVE debrief

A Cross-Site Request Forgery (CSRF) vulnerability exists in the LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress. This vulnerability affects all versions up to, and including, 5.6.0. The issue arises from missing or incorrect nonce validation on the change_status function, allowing unauthenticated attackers to change the status of arbitrary invoices, including marking unpaid invoices as paid, without administrator consent via a forged request.

Vendor
latepoint
Product
LatePoint – Calendar Booking Plugin for Appointments and Events
CVSS
MEDIUM 4.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-06
Original CVE updated
2026-07-23
Advisory published
2026-06-06
Advisory updated
2026-07-23

Who should care

Users of the LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress, particularly those with versions up to and including 5.6.0, should be aware of this vulnerability. Site administrators are at risk as an attacker could trick them into performing an action such as clicking on a link, leading to potential unauthorized changes to invoice statuses.

Technical summary

The vulnerability is characterized by a CVSS score of 4.3 and a severity rating of MEDIUM. It falls under CWE-352, Cross-Site Request Forgery. The exploit requires no privileges (PR:N), can be launched remotely (AV:N), and involves user interaction (UI:R). The impact is limited to integrity (I:L) with no confidentiality (C:N) or availability (A:N) impact.

Defensive priority

MEDIUM

Recommended defensive actions

  • Update the LatePoint – Calendar Booking Plugin for Appointments and Events to a version beyond 5.6.0.
  • Implement additional security measures to verify the legitimacy of requests changing invoice statuses.
  • Educate site administrators on the risks of clicking on unverified links.

Evidence notes

Evidence of this vulnerability comes from the National Vulnerability Database (NVD) and Wordfence security research. References include specific lines of code from the plugin's Git repository and a detailed vulnerability report from Wordfence.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-9719 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-9719

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-9719 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-9719

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.