Description
The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.1.92 via the 'view_booking_summary_in_lightbox' due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to retrieve appointment details such as customer names and email addresses.
Published: 2025-05-14
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Information disclosure
Action: Immediate patch
AI Analysis

Impact

The LatePoint Calendar Booking Plugin for WordPress contains an insecure direct object reference vulnerability in the 'view_booking_summary_in_lightbox' function. Missing validation on a user-controlled key lets an unauthenticated user request booking summaries and obtain sensitive data such as customer names and email addresses. This weakness is classified as CWE-639, reflecting an authorization failure that allows data exposure.

Affected Systems

The vulnerability affects all installations of the LatePoint – Calendar Booking Plugin for Appointments and Events up to and including version 5.1.92. No other affected products or versions are specified.

Risk and Exploitability

The CVSS score of 5.3 indicates moderate severity, and the EPSS score of less than 1% shows a very low probability of exploitation at the time of this analysis. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves a remote attacker sending a crafted HTTP request that includes the unvalidated key to the 'view_booking_summary_in_lightbox' endpoint, which can be performed without authentication.

Generated by OpenCVE AI on April 21, 2026 at 20:49 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the LatePoint plugin to version 5.1.93 or newer to receive the security fix
  • If an immediate upgrade is not possible, block unauthenticated access to booking summary pages, for example by requiring user login or adding a WordPress capability check before rendering the summary
  • Implement input validation or access control checks on any user-supplied identifiers used to retrieve booking information to prevent direct object reference

Generated by OpenCVE AI on April 21, 2026 at 20:49 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2025-14868 The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.1.92 via the 'view_booking_summary_in_lightbox' due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to retrieve appointment details such as customer names and email addresses.
History

Wed, 14 May 2025 14:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 14 May 2025 11:30:00 +0000

Type Values Removed Values Added
Description The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.1.92 via the 'view_booking_summary_in_lightbox' due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to retrieve appointment details such as customer names and email addresses.
Title Latepoint <= 5.1.92 - Unauthenticated Insecure Direct Object Reference
Weaknesses CWE-639
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-04-08T17:03:11.190Z

Reserved: 2025-04-17T15:37:44.705Z

Link: CVE-2025-3769

cve-icon Vulnrichment

Updated: 2025-05-14T13:28:06.697Z

cve-icon NVD

Status : Deferred

Published: 2025-05-14T12:15:18.747

Modified: 2026-04-15T00:35:42.020

Link: CVE-2025-3769

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-21T21:00:36Z

Weaknesses