Appointment Booking Plugin – LatePoint vulnerabilities

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling plugin for WordPress is vulnerable to generic SQL Injection via the 'booking[service_id]' parameter in all versions up to and including 5.7.2 due to insufficient escaping and lack of query preparation. Unauthenticated attackers can append additional SQL queries to extract sensitive information from the database.

The Appointment Booking Plugin – LatePoint for WordPress is vulnerable to Insecure Direct Object Reference / Missing Authorization in versions up to and including 5.7.2. Unauthenticated attackers can create approved appointments against other customers' order items and read their personal data.

The Appointment Booking Plugin – LatePoint for WordPress up to version 5.7.0 is vulnerable to arbitrary shortcode execution. An unauthenticated attacker can plant a malicious shortcode during the booking flow, which gets executed when the Customer Cabinet block renders the stored name.