The LatePoint plugin contains a missing capability check in the load_step() function, making it possible for unauthenticated attackers to retrieve booking details such as customer names, email addresses, phone numbers, appointment times, and service information. The vulnerability allows a confidentiality breach, exposing personal data that could be leveraged for identity theft or phishing campaigns. This vulnerability is a CWE-862: Missing Authorization.

WordPress sites using the LatePoint – Calendar Booking Plugin for Appointments and Events, specifically all releases up to and including version 5.2.6.

The CVSS score of 5.3 indicates a medium severity vulnerability. With an EPSS score of less than 1 percent, exploitation likelihood is currently very low, and the vulnerability is not listed in the CISA KEV catalog. However, because unauthenticated access is possible, the risk to individuals’ personal information remains significant if an attacker can remotely query the load_step endpoint. The threat remains moderate in terms of impact magnitude, but the window for exploitation is essentially open to anyone who can identify the vulnerable endpoint.