The LatePoint Appointment Booking Plugin for WordPress is vulnerable to an Insecure Direct Object Reference flaw that exposes private appointment, agent, scheduling, and pricing details to any web user. The vulnerability allows an unauthenticated attacker to supply values for the booking[id] or cart[id] parameters on the steps__reload_booking_form_summary_panel and steps__start Ajax routes, which the plugin processes without verifying that the requester owns the referenced record. Consequently, enumerating sequential numeric identifiers yields the complete contents of any customer’s booking or cart in a JSON response, leaking sensitive data such as service names, agents, dates, durations, prices, and checkout status.

Any WordPress installation that has the LatePoint plugin version 5.7.3 or earlier is affected. The flaw exists in the core plugin code where the public routes lack ownership validation for the incoming identifiers, allowing attackers to discover and read information from other customers’ appointments or shopping carts.

The CVSS score of 7.5 indicates a high confidentiality impact with moderate complexity. The EPSS score of <1% suggests that exploitation is currently uncommon, and the issue is not listed in CISA’s KEV catalog. Attackers can trigger the flaw by sending crafted Ajax requests to the publicly accessible endpoint wp_ajax_nopriv_latepoint_route_call, iterating booking or cart IDs to harvest data. No privileged or authenticated access is required; the vector is purely unauthenticated and network-based.