CVE-2026-103380
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
The Appointment Booking Plugin – LatePoint for WordPress is vulnerable to Sensitive Information Exposure in all versions up to 5.7.3 via the 'params[customer][first_name]' parameter. Authenticated attackers with subscriber-level access and above can extract privileged booking data including admin_notes, agent contact details, transaction tokens, and payment request URLs.
Risk Assessment
The risk includes exposure of sensitive business and customer data, potentially leading to privacy violations, financial fraud, or social engineering attacks.
Recommendation
Update the plugin to the latest version and restrict access to sensitive fields to authorized roles only.
Other vulnerabilities in Appointment Booking Plugin – LatePoint
See all- CVE-2026-92966Critical
The Appointment Booking Plugin – LatePoint for WordPress up to version 5.7.0 is vulnerable to arbitrary shortcode execution. An unauthenticated attacker can plant a malicious shortcode during the booking flow, which gets executed when the Customer Cabinet block renders the stored name.
- CVE-2026-96662High
The Appointment Booking Plugin – LatePoint | Calendar & Scheduling plugin for WordPress is vulnerable to generic SQL Injection via the 'booking[service_id]' parameter in all versions up to and including 5.7.2 due to insufficient escaping and lack of query preparation. Unauthenticated attackers can append additional SQL queries to extract sensitive information from the database.
- CVE-2026-91050Medium
The Appointment Booking Plugin – LatePoint for WordPress is vulnerable to Insecure Direct Object Reference / Missing Authorization in versions up to and including 5.7.2. Unauthenticated attackers can create approved appointments against other customers' order items and read their personal data.
Original NVD description (English source)
The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.7.3 via the 'params[customer][first_name]' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract privileged booking data including the administrator-only admin_notes field, assigned agent internal contact details, transaction tokens, and payment request URLs delivered via rendered notification emails. A LatePoint customer can exploit this by storing a template placeholder such as {{customer_admin_notes}} in their own first_name field via the customer_cabinet__update route, then triggering the password-reset email flow to receive the expanded value in the resulting notification.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS