The LatePoint Appointment Booking Plugin is vulnerable to an ORM operator injection flaw in the 'customer[uuid]' parameter. The flaw allows an unauthenticated attacker to enumerate UUID prefixes via the steps__load_step AJAX endpoint, causing the plugin to return the first name, last name, email address, phone number, and notes of every customer record. The vulnerability is a classic sensitive information disclosure, classified as CWE‑200, and can be triggered when the plugin is configured with guest checkout mode, disabling user authentication.

All installations of the LatePoint Appointment Booking Plugin for WordPress up to and including version 5.7.4 are vulnerable. Any WordPress site that uses this plugin and is configured to allow guest checkout is at risk.

The CVSS score of 3.7 indicates moderate severity. While no EPSS score is available and the vulnerability is not listed in the CISA KEV catalog, the attack vector is straightforward: an attacker merely needs to send crafted requests to the unauthenticated AJAX endpoint. Because the flaw relies on parameter exploitation rather than complex prerequisites, the likelihood of exploitation remains non‑negligible in environments where the plugin is left in guest checkout mode.