The LatePoint Appointment Booking Plugin for WordPress is affected by an insecure direct object reference, identified as CWE‑639. In vulnerable versions up to 5.7.1, unauthenticated users can call the wp_ajax_nopriv_latepoint_route_call endpoint and provide a numeric `invoice_id`. The handler loads the corresponding invoice record without verifying ownership or requiring a unique access key, then creates or updates a transaction intent. This flaw allows attackers to enumerate all invoices belonging to any customer, forge transaction intents tied to other users’ invoices, or overwrite the intent key used by legitimate payment webhooks, potentially causing duplicate charges or disabling automated payment notifications.

LatePoint, the Calendar & Scheduling plugin for WordPress, is impacted in all releases up to and including 5.7.1. Versions released after 5.7.1 are not affected according to the advisory. The vulnerability is tied to the public AJAX route defined in OsPaypalConnectController and related transaction helper classes.

The defect carries a CVSS score of 5.3, reflecting moderate impact. No EPSS score is available, and the issue is not listed in CISA’s KEV catalog. Attackers need only send unauthenticated HTTP requests to the wp_ajax_nopriv_latepoint_route_call endpoint with sequential invoice IDs; no credentials or advanced configuration are required. Because the attack does not rely on complex setup or privilege escalation, the likelihood of exploitation remains moderate but non-negligible, especially for WordPress sites that lack additional access controls.