LatePoint WordPress plugin does not validate a client‑supplied parameter that controls the charge amount when booking a service. An attacker can set this value to zero, causing the system to record a confirmed appointment and an order while no payment is collected. This flaw allows unauthenticated users to create valid bookings without completing any financial transaction, resulting in financial loss and service abuse. The behavior is inferred from the plugin’s payment handling logic described in the CVE description.

The vulnerability affects the LatePoint WordPress plugin before version 5.7.5. Any WordPress site that has an earlier version of this plugin installed is potentially exposed.

The CVSS score of 5.3 places this flaw in the medium severity range, and the EPSS is not available, indicating no publicly known exploitation data. The flaw is not listed in CISA’s KEV catalog. The description explicitly states that the attack does not require authentication and relies on manipulating a publicly accessible input field, so the exploit difficulty is low. Based on the description, the likely attack path is to craft a request to the booking endpoint and set the payment_portion parameter to zero, bypassing payment and creating fraudulent confirmed appointments.