These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure. This vulnerability allows unauthenticated attackers to extract customer records by enumerating uuid prefixes via the unauthenticated steps__load_step AJAX endpoint when the plugin is configured with 'Field used for authentication' set to 'Disable ability to [truncated]
The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Authentication Bypass via Race Condition in all versions up to, and including, 5.7.4. This vulnerability allows unauthenticated attackers to bypass the 10-attempt lockout and brute-force the 6-digit OTP code, gaining full access to targeted LatePoint customer accounts, bookings, and personal data.
The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin is vulnerable to Sensitive Information Exposure in versions up to and including 5.7.3. Authenticated attackers with subscriber-level access can exploit this by storing a template placeholder in their first_name field and triggering the password-reset email flow to receive expanded privileged booking data.
The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 5.7.3 via the `booking[id]` and `cart[id]` parameters on the `steps__reload_booking_form_summary_panel` and `steps__start` public routes (reachable through wp_ajax_nopriv_latepoint_route_call).
The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 5.7.2 via the OsCustomerHelper::create_wp_user_for_customer() helper reached from the public process_step_customer() booking step. When the 'Use WordPress users as customers' option is enabled, the helper falls back from email_exists [truncated]
The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to unauthenticated SQL Injection via the 'booking[service_id]' parameter in versions up to and including 5.7.2. This vulnerability allows unauthenticated attackers to append additional SQL queries to existing queries, potentially leading to sensitive information extraction from the database.
The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference / Missing Authorization in versions up to, and including, 5.7.2. This is due to the publicly reachable steps__start and steps__load_step routes accepting a params[presets][order_item_id] value that is copied verbatim into the booking object without verifyi [truncated]
The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin is vulnerable to Privilege Escalation in versions up to and including 5.7.3. Authenticated attackers with the `settings__edit` capability can overwrite the default WordPress role for new customers with `administrator`, allowing self-registered LatePoint customer accounts to be created with full WordPress administrator privileges.
The Appointment Booking Plugin for WordPress, version prior to 5.7.3, contains a vulnerability allowing unauthenticated disclosure of customer personal identifiable information (PII) via an insecure direct object reference (IDOR). An attacker can exploit this by supplying a sequential order-item ID to retrieve any customer's name, contact details, and order confirmation code.
The Appointment Booking Plugin for WordPress, version prior to 5.6.5, is vulnerable to an insecure direct object reference (IDOR) issue. This allows an authenticated user with a staff role limited to a specific record to delete any order, customer, or transaction on the site, including records outside their assigned scope. The vulnerability was reported by WPScan and documented in the CVE Program record a [truncated]
The Appointment Booking Plugin WordPress plugin before 5.6.9 does not enforce per-record authorization on several of its AI Abilities API actions, allowing an authenticated user holding the LatePoint Agent role, normally restricted to their own records, to read and modify other agents' profile data and read other agents' bookings and associated customer details when the Abilities API feature is enabled.
The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin, versions up to and including 5.6.9, is vulnerable to Insecure Direct Object Reference. This vulnerability allows authenticated attackers with Subscriber-level access to modify arbitrary customer personal information. The plugin fails to perform adequate ownership checks, enabling attackers to alter customer data, incl [truncated]
The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference. This vulnerability allows unauthenticated attackers to enumerate invoices, create unauthorized transaction-intent rows, and overwrite intent_keys, potentially breaking payment webhooks for affected customers.
The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.6.3. This vulnerability allows attackers with LatePoint Agent-level access and above to read bookings and customer PII assigned to other LatePoint agents and delete arbitrary bookings by supplying any booking ID, but only when an [truncated]
The LatePoint plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'btn_wrapper_classes' attribute of the 'latepoint_resources' shortcode in all versions up to, and including, 5.3.2. This is due to insufficient input sanitization and output escaping in the 'locations' branch of the 'shortcode_latepoint_resources' function. This vulnerability allows authenticated attackers with contrib [truncated]
A SQL Injection vulnerability was discovered in LatePoint, a WordPress plugin, affecting versions from n/a through 5.6.3. This issue allows for Blind SQL Injection, with a CVSS score of 9.3 and a severity of CRITICAL. The vulnerability is caused by improper neutralization of special elements used in an SQL command. Users of LatePoint should be aware of this vulnerability and take immediate action to prote [truncated]
The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Improper Input Validation in all versions up to, and including, 5.4.0. This vulnerability allows unauthenticated attackers to pay an arbitrary amount by supplying a previously succeeded PaymentIntent token due to the plugin's Stripe Connect payment processor accepting a client-supplied PaymentIntent I [truncated]
CVE-2026-8176 is a Privilege Escalation vulnerability in the LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress. The vulnerability affects versions up to, and including, 5.5.1. An authenticated Agent (Agent+) can exploit this vulnerability to elevate their privileges to Administrator without invoking an Administrator-only API.
CVE-2026-49083 is a HIGH severity vulnerability (CVSS Score: 7.5) in the LatePoint plugin versions <= 5.5.1. This vulnerability allows for contributor privilege escalation. The CVE was published on 2026-06-15T21:17:20.150Z and last modified on 2026-06-15T21:24:32.790Z.
A Cross-Site Request Forgery (CSRF) vulnerability exists in the LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress. This vulnerability affects all versions up to, and including, 5.6.0. The issue arises from missing or incorrect nonce validation on the change_status function, allowing unauthenticated attackers to change the status of arbitrary invoices, including marking u [truncated]
The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'button_caption' parameter in the [latepoint_resources] shortcode in versions up to and including 5.3.0. This is due to insufficient output escaping when the 'items' parameter is set to 'bundles'. This makes it possible for authenticated attackers, with contributor- [truncated]