The LatePoint Appointment Booking Plugin stores user-supplied first and last name values and later passes them to WordPress core’s do_shortcode function without proper validation. This allows an attacker who can submit a booking request without authenticating to embed a malicious shortcode. When the Customer Cabinet block renders the stored name, WordPress re‑parses the shortcode payload and executes it. The flaw is a form of arbitrary code execution, allowing an attacker to run custom code inside the WordPress environment, potentially compromising the entire site.

All installations of the LatePoint Appointment Booking Plugin up to and including version 5.7.0 are affected. The vulnerability resides in the plugin code that handles user booking data and displays it in the customer dashboard. Users running version 5.7.0 or earlier on any WordPress site are at risk.

The CVSS score of 9.1 indicates a critical severity, and the flaw can be exploited by unauthenticated actors through the public booking interface. No EPSS score is available, but the absence of a KEV listing does not reduce the risk; the attack vector is straightforward and requires no special privileges. If an attacker can gain the ability to submit a booking request, they can trigger the vulnerable shortcode path and execute arbitrary code on the server. Organizations with publicly accessible booking workflows should assume a high likelihood of exploitation until the plugin is updated.