The LatePoint plugin, used in WordPress sites to manage appointments, contains a Cross‑Site Request Forgery flaw. The missing nonce check in the request_cancellation() function allows an unauthenticated attacker to craft a request that, if the victim clicks a malicious link while logged in, cancels an existing booking. The vulnerability is a classic instance of CWE‑352 and enables an attacker to alter the state of a booking without any authentication.

LatePoint, the calendar booking plugin for WordPress, is vulnerable in all releases up to and including 5.3.2. Upgrading to 5.4.0 or newer resolves the issue; no other products or versions are listed as affected.

The CVSS score of 4.3 indicates moderate severity. EPSS information is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited evidence of exploitation. Attackers would rely on user interaction (the victim clicking a crafted link) to trigger the forged request, meaning a mitigated likelihood if users are cautious. Nonetheless, the lack of nonce verification makes the flaw straightforward to exploit for an attacker who has already obtained a working URL that triggers cancellation.