The vulnerability in LatePoint is an Insecure Direct Object Reference that allows an attacker to manipulate a key parameter in a request and bypass the plugin’s authorization checks. This flaw permits unauthorized reading of appointment data and other sensitive information that should be protected. The weakness corresponds to CWE‑639.

All releases of the LatePoint WordPress plugin from its initial version through version 5.2.6 are affected. No release prior to 5.2.7 contains a fix for this IDOR flaw.

The CVSS base score of 6.5 indicates a moderate severity issue, while the EPSS below 1 % suggests that exploitation is unlikely to be common in the wild. Because the vulnerability is not listed in the CISA KEV catalog, it is not known to be actively exploited at scale. Based on the description, the likely attack vector is a crafted web request that modifies the key field to reference another object, meaning the attack requires network access to the site and the ability to influence URL or POST parameters. This combination of moderate severity, low exploitation probability, and the ability for an attacker to read confidential data results in a significant risk that warrants prompt remediation.