LatePoint, a WordPress calendar booking plugin, contains an insecure direct object reference that allows unauthenticated users to submit a service_id parameter when loading a booking step or starting a booking, bypassing role‑based checks. This flaw lets an attacker create approved bookings for services that are normally limited to administrators or agents, effectively consuming restricted appointment slots and inserting unauthorized appointments into the system. The weakness is identified as CWE‑639, which describes a classic IDOR scenario.

WordPress installations running LatePoint version 5.6.2 or earlier are affected. The vulnerable functionality resides in the steps__load_step and steps__start endpoints, which are publicly accessible without authentication. Any site that has an unpatched LatePoint deployment and exposes its booking interfaces is at risk.

The CVSS score of 5.3 indicates a moderate impact, but the EPSS score of less than 1 % suggests a low current exploitation likelihood. The vulnerability is not cataloged in the CISA KEV list. Exploitation requires only unauthenticated HTTP requests to the publicly exposed booking endpoints with a manipulated service_id; no special privileges or credentials are needed, making the attack vector straightforward and remote.