CVE-2026-103366: CWE-639 Authorization Bypass Through User-Controlled Key in latepoint Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress

CVE-2026-103366 is an authorization bypass vulnerability (CWE-639) in the LatePoint Appointment Booking Plugin for WordPress, affecting versions up to 5.7.3. The issue exists due to the plugin's OsStepsHelper::set_required_objects() method passing raw user-controlled booking[id] and cart[id] parameters into functions that load booking or cart data by primary key without verifying ownership. While an ownership guard exists in OsStepsHelper::load_step(), it does not cover the affected AJAX routes (steps__reload_booking_form_summary_panel and steps__start) or the cart[id] parameter. This allows unauthenticated attackers to enumerate sequential booking and cart IDs and retrieve sensitive appointment details and pending checkout contents from JSON responses.

An unauthenticated attacker can enumerate booking and cart identifiers to access sensitive information about other customers' appointments, including service name, agent, date/time, duration, price breakdown, and status, as well as other shoppers' pending checkout data. This results in a confidentiality breach with high impact on customer privacy. There is no indication of integrity or availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected AJAX endpoints if possible, and monitor for suspicious activity related to booking and cart enumeration. Avoid exposing booking and cart identifiers in URLs or client-side code. Follow vendor updates closely for an official fix.