PatchSiren cyber security CVE debrief
CVE-2026-9719 latepoint CVE debrief
A Cross-Site Request Forgery (CSRF) vulnerability exists in the LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress. This vulnerability affects all versions up to, and including, 5.6.0. The issue arises from missing or incorrect nonce validation on the change_status function, allowing unauthenticated attackers to change the status of arbitrary invoices, including marking unpaid invoices as paid, without administrator consent via a forged request.
- Vendor
- latepoint
- Product
- LatePoint – Calendar Booking Plugin for Appointments and Events
- CVSS
- MEDIUM 4.3
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-06-06
- Original CVE updated
- 2026-07-23
- Advisory published
- 2026-06-06
- Advisory updated
- 2026-07-23
Who should care
Users of the LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress, particularly those with versions up to and including 5.6.0, should be aware of this vulnerability. Site administrators are at risk as an attacker could trick them into performing an action such as clicking on a link, leading to potential unauthorized changes to invoice statuses.
Technical summary
The vulnerability is characterized by a CVSS score of 4.3 and a severity rating of MEDIUM. It falls under CWE-352, Cross-Site Request Forgery. The exploit requires no privileges (PR:N), can be launched remotely (AV:N), and involves user interaction (UI:R). The impact is limited to integrity (I:L) with no confidentiality (C:N) or availability (A:N) impact.
Defensive priority
MEDIUM
Recommended defensive actions
- Update the LatePoint – Calendar Booking Plugin for Appointments and Events to a version beyond 5.6.0.
- Implement additional security measures to verify the legitimacy of requests changing invoice statuses.
- Educate site administrators on the risks of clicking on unverified links.
Evidence notes
Evidence of this vulnerability comes from the National Vulnerability Database (NVD) and Wordfence security research. References include specific lines of code from the plugin's Git repository and a detailed vulnerability report from Wordfence.
Sources and references
Verified primary and authoritative sources
-
CVE-2026-9719 CVE Program record
Publisher, destination, and source semantics verified
URL: https://www.cve.org/CVERecord?id=CVE-2026-9719
CVE Program - Official CVE Program record with source-provided CVE metadata.
-
CVE-2026-9719 NVD vulnerability detail
Publisher, destination, and source semantics verified
URL: https://nvd.nist.gov/vuln/detail/CVE-2026-9719
NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.
Supplemental references
-
Source reference
Unverified legacy reference
URL: https://plugins.trac.wordpress.org/browser/latepoint/tags/5.3.0/lib/controllers/invoices_controller.php
-
Source reference
Unverified legacy reference
URL: https://plugins.trac.wordpress.org/browser/latepoint/tags/5.3.0/lib/controllers/invoices_controller.php
-
Source reference
Unverified legacy reference
URL: https://plugins.trac.wordpress.org/browser/latepoint/tags/5.3.0/lib/helpers/params_helper.php
-
Source reference
Unverified legacy reference
URL: https://plugins.trac.wordpress.org/browser/latepoint/tags/5.6.0/lib/controllers/invoices_controller.php
-
Source reference
Unverified legacy reference
URL: https://plugins.trac.wordpress.org/browser/latepoint/tags/5.6.0/lib/controllers/invoices_controller.php
-
Source reference
Unverified legacy reference
URL: https://plugins.trac.wordpress.org/browser/latepoint/tags/5.6.0/lib/helpers/params_helper.php
-
Source reference
Unverified legacy reference
URL: https://plugins.trac.wordpress.org/changeset/3553094/latepoint
Methodology and review provenance
AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.