CVE-2026-96662
HighCVSS 7.5Summary
The Appointment Booking Plugin – LatePoint | Calendar & Scheduling plugin for WordPress is vulnerable to generic SQL Injection via the 'booking[service_id]' parameter in all versions up to and including 5.7.2 due to insufficient escaping and lack of query preparation. Unauthenticated attackers can append additional SQL queries to extract sensitive information from the database.
Risk Assessment
An attacker can access user data, passwords, payment information, and other sensitive data stored in the database, potentially leading to serious security breaches.
Recommendation
Update the plugin to the latest patched version. Additionally, use prepared statements and input validation.
Other vulnerabilities in Appointment Booking Plugin – LatePoint
See all- CVE-2026-91050Medium
The Appointment Booking Plugin – LatePoint for WordPress is vulnerable to Insecure Direct Object Reference / Missing Authorization in versions up to and including 5.7.2. Unauthenticated attackers can create approved appointments against other customers' order items and read their personal data.
- CVE-2026-92966Critical
The Appointment Booking Plugin – LatePoint for WordPress up to version 5.7.0 is vulnerable to arbitrary shortcode execution. An unauthenticated attacker can plant a malicious shortcode during the booking flow, which gets executed when the Customer Cabinet block renders the stored name.
Original NVD description (English source)
The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to generic SQL Injection via 'booking[service_id]' Parameter in all versions up to, and including, 5.7.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS