The plugin’s customer first_name field allows an authenticated subscriber to insert a placeholder such as {{customer_admin_notes}}. When a password‑reset email is sent, the system expands this placeholder and injects data from internal fields—admin notes, agent contact, transaction tokens, and payment URLs—into the email. An attacker can therefore read privileged booking information that should be restricted to administrators. The flaw is a template re‑expansion vulnerability that results in confidential data disclosure.

LatePoint, Appointment Booking Plugin – LatePoint, Calendar & Scheduling for WordPress, versions 5.7.3 and earlier.

The CVSS score is 4.3, indicating moderate impact. EPSS is less than 1 percent, showing a very low probability of exploitation in the wild. The flaw is not yet listed in the CISA KEV catalog. Attackers need only subscriber‑level authentication, after which the exploitation path is straightforward: store a malicious placeholder, trigger a password‑reset, and capture the expanded email. The risk is mainly confidentiality leakage, potentially leading to financial fraud or privacy violations, but the lack of a publicly known exploit and the requirement for legitimate credentials keeps the overall threat moderate.