CVE-2026-1537

LatePoint – Calendar Booking Plugin for Appointments and Events <= 5.2.6 - Missing Authorization to Booking Details Exposure

View on CVE.org

Published Feb 12, 2026 CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Description

The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the load_step() function in all versions up to, and including, 5.2.6. This makes it possible for unauthenticated attackers to view booking information including customer names, email addresses, phone numbers, appointment times, and service details.

Analysis

Technical impact

The LatePoint plugin contains a missing capability check in the load_step() function, making it possible for unauthenticated attackers to retrieve booking details such as customer names, email addresses, phone numbers, appointment times, and service information. The vulnerability allows a confidentiality breach, exposing personal data that could be leveraged for identity theft or phishing campaigns. This vulnerability is a CWE-862: Missing Authorization.

Affected Systems

WordPress sites using the LatePoint – Calendar Booking Plugin for Appointments and Events, specifically all releases up to and including version 5.2.6.

Risk and Exploitability

The CVSS score of 5.3 indicates a medium severity vulnerability. With an EPSS score of less than 1 percent, exploitation likelihood is currently very low, and the vulnerability is not listed in the CISA KEV catalog. However, because unauthenticated access is possible, the risk to individuals’ personal information remains significant if an attacker can remotely query the load_step endpoint. The threat remains moderate in terms of impact magnitude, but the window for exploitation is essentially open to anyone who can identify the vulnerable endpoint.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

latepoint

LatePoint – Calendar Booking Plugin for Appointments and Events

unaffected

Version	Status	Constraints
`0`	affected	≤ 5.2.6

No data.

Vendor Product Versions

Latepoint

Latepoint – Calendar Booking Plugin For Appointments And Events

Version	Status	Scheme	Platform
`[0,5.2.6]`	affected	semver	—

Wordpress

Version	Status	Scheme	Platform
`—`	unaffected	—	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the LatePoint plugin to a version newer than 5.2.6, which contains the missing capability check.
If an immediate upgrade is not feasible, implement server‑side or WordPress‑level restrictions to block unauthenticated requests to the load_step endpoint, such as using .htaccess rules or a firewall.
Review any custom code or configurations that expose booking data to ensure that all endpoints perform proper capability checks before returning sensitive information.

Generated by OpenCVE AI on April 15, 2026 at 18:34 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.290% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://plugins.trac.wordpress.org/browser/latepoint/tags/5.2.5/lib/helpers/steps_helper.php#L231
https://plugins.trac.wordpress.org/browser/latepoint/tags/5.2.5/lib/models/model.php#L562
https://www.wordfence.com/threat-intel/vulnerabilities/id/c18ad885-52a8-467b-83f2-aeb0c8be8be0?source=cve

History

Feb 12, 2026 4:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Feb 12, 2026 9:45 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Latepoint Latepoint latepoint – Calendar Booking Plugin For Appointments And Events Wordpress Wordpress wordpress
Vendors & Products		Latepoint Latepoint latepoint – Calendar Booking Plugin For Appointments And Events Wordpress Wordpress wordpress

Feb 12, 2026 3:30 AM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the load_step() function in all versions up to, and including, 5.2.6. This makes it possible for unauthenticated attackers to view booking information including customer names, email addresses, phone numbers, appointment times, and service details.
Title		LatePoint – Calendar Booking Plugin for Appointments and Events <= 5.2.6 - Missing Authorization to Booking Details Exposure
Weaknesses		CWE-862
References		https://plugins.trac.wordpress.org/browser/latepoint/tags/5.2.5/lib/helpers/steps_helper.php#L231 https://plugins.trac.wordpress.org/browser/latepoint/tags/5.2.5/lib/models/model.php#L562 https://www.wordfence.com/threat-intel/vulnerabilities/id/c18ad885-52a8-467b-83f2-aeb0c8be8be0?source=cve
Metrics		cvssV3_1 `{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'}`