LatePoint is a WordPress calendar booking plugin that contains an insecure direct object reference that allows unauthenticated users to supply a service_id when loading a booking step or starting a booking, bypassing role‑based checks. This flaw enables the creation of approved bookings for services normally restricted to administrators or agents, effectively consuming limited appointment slots and inserting unauthorized reservations into the system. The weakness is identified as CWE‑639, a classic IDOR scenario.

WordPress installations running LatePoint 5.6.2 or earlier are affected. The vulnerability resides in the steps__load_step and steps__start endpoints, which are publicly accessible without authentication. Any site that has an unpatched LatePoint deployment and exposes its booking interfaces is at risk.

The CVSS score of 5.3 indicates a moderate impact, but the EPSS score of less than 1 % suggests a low current exploitation likelihood. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires only unauthenticated HTTP requests to the publicly exposed booking endpoints with a manipulated service_id; no special privileges or credentials are needed, making the attack vector straightforward and remote.