The vulnerability in LatePoint’s process_step_customer() allows an unauthenticated attacker to alter a customer’s first name, last name, phone number, and notes by submitting the booking form with a known email address. This is an authorization bypass (CWE‑862) that compromises the confidentiality and integrity of personally identifiable information. Based on the description, it is inferred that the modification could lead to privacy violations or reputational harm. The plugin does not verify that the user is permitted to perform the update, allowing any visitor to modify any customer record, even those tied to administrators.

All installations of LatePoint – Calendar Booking Plugin for WordPress up to and including version 5.6.1 with guest bookings enabled (is_customer_auth_disabled() returning true).

The CVSS score of 5.3 indicates moderate severity, and the EPSS score of <1% suggests a very low but nonzero probability of exploitation. The vulnerability is not listed in the CISA KEV catalogue, indicating no widespread public exploitation yet. While the authorization bypass is straightforward, the very low EPSS reflects limited documented for specific knowledge of the guest booking configuration. Nonetheless, the potential for privacy violations warrants prompt remediation.