CVE-2026-103380: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor in latepoint Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress

CVE-2026-103380 is a sensitive information exposure vulnerability (CWE-200) in the LatePoint Appointment Booking Plugin for WordPress. Versions up to and including 5.7.3 are affected. Authenticated attackers with subscriber-level privileges can exploit the 'params[customer][first_name]' parameter to inject template placeholders such as {{customer_admin_notes}} into their first_name field. When the password-reset email flow is triggered, the plugin expands these placeholders and includes privileged booking data in the notification emails. This data includes administrator-only admin_notes, assigned agent internal contact details, transaction tokens, and payment request URLs, exposing sensitive information to unauthorized users.

The vulnerability allows unauthorized disclosure of sensitive booking data to authenticated users with subscriber-level access or higher. This includes administrator-only notes, internal contact details of assigned agents, transaction tokens, and payment request URLs. While it does not allow modification or deletion of data, the exposure of this information could lead to privacy violations and potential misuse of transaction-related data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict subscriber-level access where possible and monitor for suspicious activity involving the password-reset email flow. Avoid storing template placeholders in user-controlled fields such as first_name. Follow vendor updates closely for an official fix.