Description
The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.6.9 via the set_customer_object due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to enumerate arbitrary customer records and disclose personally identifiable information - including first name, last name, email address, and phone number - by iterating the customer[id] parameter. This issue is exploitable only when the site is configured with customer authentication disabled (guest checkout enabled).
Published: 2026-09-17
Score: 4.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Sensitive information disclosure via unauthenticated enumeration
Action: Immediate Patch
AI Analysis

Impact

LatePoint, the Appointment Booking Plugin for WordPress, has an insecure direct object reference vulnerability that allows unauthenticated attackers to enumerate and expose customer records, exposing personally identifiable information such as first name, last name, email address, and phone number.

Affected Systems

The vulnerability affects all versions of LatePoint up to and including 5.6.9. WordPress sites using these plugin releases with guest checkout enabled (customer authentication disabled) are at risk.

Risk and Exploitability

The CVSS score of 4.3 indicates medium severity, and the EPSS score of less than 1% shows a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw by sending requests with a manipulated customer[id] parameter on a public WordPress site that has guest checkout enabled, requiring no authentication.

Generated by OpenCVE AI on September 19, 2026 at 01:07 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the LatePoint plugin to the latest version (5.7 or later) where the issue is fixed.
  • If an upgrade is not immediately possible, disable guest checkout or enforce customer authentication to prevent unauthenticated enumeration.
  • Deploy a web application firewall or implement rate limiting on the customer[id] parameter to reduce enumeration attempts.

Generated by OpenCVE AI on September 19, 2026 at 01:07 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 19 Sep 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 18 Sep 2026 13:15:00 +0000

Type Values Removed Values Added
First Time appeared Latepoint
Latepoint appointment Booking Plugin – Latepoint | Calendar & Scheduling For Wordpress
Wordpress
Wordpress wordpress
Vendors & Products Latepoint
Latepoint appointment Booking Plugin – Latepoint | Calendar & Scheduling For Wordpress
Wordpress
Wordpress wordpress

Thu, 17 Sep 2026 23:45:00 +0000

Type Values Removed Values Added
Description The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.6.9 via the set_customer_object due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to enumerate arbitrary customer records and disclose personally identifiable information - including first name, last name, email address, and phone number - by iterating the customer[id] parameter. This issue is exploitable only when the site is configured with customer authentication disabled (guest checkout enabled).
Title LatePoint - Appointment Booking & Scheduling <= 5.6.9 - Unauthenticated Insecure Direct Object Reference to Sensitive Information Disclosure via 'customer[id]' Parameter
Weaknesses CWE-639
References
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'}

Subscriptions

Latepoint Appointment Booking Plugin – Latepoint | Calendar & Scheduling For Wordpress
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-09-19T14:21:52.663Z

Reserved: 2026-07-30T20:33:41.814Z

Link: CVE-2026-18441

cve-icon Vulnrichment

Updated: 2026-09-19T14:14:58.035Z

cve-icon NVD

Status : Deferred

Published: 2026-09-18T00:16:57.297

Modified: 2026-09-19T15:16:58.823

Link: CVE-2026-18441

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-19T01:15:16Z

Weaknesses
  • CWE-639

    Authorization Bypass Through User-Controlled Key