Based on the description, the LatePoint plugin for WordPress accepts a client‑supplied PaymentIntent ID and forwards it to Stripe without validating that the ID originated from the site. Because no authentication or ownership check is performed, it is inferred that an attacker can supply an arbitrary previously completed PaymentIntent token and trigger a charge for any amount chosen by the attacker. This flaw permits unauthenticated fraud, potentially draining funds from the site’s Stripe account or causing the site to settle unintended claims. The weakness aligns with a missing authorization failure under CWE‑862.

All WordPress sites running LatePoint – Calendar Booking Plugin for Appointments and Events version 5.4.0 or earlier are affected. The vendor product is LatePoint, and any installation that has not migrated beyond the specified version coordinates is exposed, regardless of the site’s user roles.

The vulnerability carries a CVSS score of 7.5, classifying it as high severity. Its EPSS score is listed as < 1 %, indicating a very low exploitation probability at this time, and it is not in the CISA KEV catalog. Based on the description, it is inferred that attackers reach the vulnerable code through the plugin’s public Stripe Connect endpoint, requiring no credentials; therefore, the risk is primarily financial loss if an attacker can locate a usable PaymentIntent token.