The LatePoint Appointment Booking Plugin for WordPress contains an Insecure Direct Object Reference flaw that lets any authenticated user with Subscriber role or higher alter customer data. The process_step_customer() function only verifies that a user is logged in before merging submitted customer information into an existing record, allowing attackers to change first name, last name, email, phone, and notes for any customer. When the contact_merge setting is set to 'phone', an attacker can overwrite a victim’s email address and gain control via a password‑reset workflow. This constitutes a moderate severity information disclosure and account takeover weakness identified as CWE‑639.

LatePoint – Appointment Booking Plugin – Calendar & Scheduling for WordPress, versions up to and including 5.6.9.

The flaw is rated a CVSS score of 5.4, reflecting a moderate impact if exploited. Although no EPSS data is currently available, the vulnerability is not listed in the CISA KEV catalog, suggesting it has not yet been widely exploited. The attack requires only that the attacker be logged into the WordPress site and possess a Subscriber‑level role or higher; no additional privileges are needed. By targeting the process_step_customer endpoint with crafted POST data, an attacker can identify or guess customer record identifiers and inject new values, thereby tampering with sensitive personal data and potentially hijacking accounts if the contact_merge setting permits email replacement.