LatePoint – Calendar Booking Plugin for Appointments and Events vulnerabilities

The LatePoint plugin for WordPress up to version 5.6.3 is vulnerable to privilege escalation to Administrator due to an Insecure Direct Object Reference (IDOR) in the create_or_update() function and missing role verification in OsAuthHelper::authorize_customer(). An authenticated attacker with Agent-level access can overwrite any customer's email, including one linked to an Administrator account, and then log in as that user.

The LatePoint – Calendar Booking Plugin for Appointments and Events for WordPress is vulnerable to Privilege Escalation to Administrator in versions up to and including 5.5.1. The plugin chains three independent flaws that allow an authenticated Agent (Agent+) to overwrite a WordPress Administrator's password without invoking an Administrator-only API.

The LatePoint plugin for WordPress up to version 5.3.0 contains a Stored XSS vulnerability via the 'button_caption' parameter in the [latepoint_resources] shortcode. Attackers with contributor-level access or higher can inject arbitrary scripts that execute when a user visits the page.