The LatePoint plugin for WordPress contains an Insecure Direct Object Reference flaw that permits an unauthenticated party to enumerate invoices. The vulnerability exists because the public OsStripeConnectController::create_payment_intent_for_transaction action loads invoices by a sequential integer invoice_id without verifying ownership or requiring authentication. The result is that attackers can obtain sensitive financial information, including invoice identifiers, order IDs, customer IDs, charge amounts, and, on sites configured with Stripe Connect, client‑secret tokens and transaction intent keys. This data compromise threatens the confidentiality of financial transactions and could facilitate fraudulent activity. The weakness is categorised as CWE-639. Based on the description, the likely attack vector is via unauthenticated HTTP requests to the exposed endpoint that provides the invoice_id parameter.

The flaw impacts every installation of the LatePoint – Calendar Booking Plugin for Appointments and Events for WordPress that is running version 5.3.2 or earlier. Any site that has this plugin, regardless of the WordPress theme or other plugins, is vulnerable. The problem is confined to the LatePoint component and does not affect other WordPress core files or plugins.

The CVSS base score is 5.3, reflecting moderate severity. The EPSS estimate is not available, and the vulnerability is not catalogued as a known exploited vulnerability. Attackers require only unauthenticated HTTP calls to a public endpoint, which can be discovered through brute‑force enumeration of sequential invoice IDs or by observing error messages. Because the exploit does not require privileged credentials or complex setup, the potential for exploitation is realistic, though there are no reports of this weakness being actively abused in the wild. The main consequence is the leakage of confidential financial data and, where Stripe Connect is enabled, sensitive authentication tokens.