CVE-2026-12657 describes an Insecure Direct Object Reference (IDOR) vulnerability in the LatePoint – Calendar Booking Plugin for Appointments and Events for WordPress. The flaw exists in all versions up to and including 5.6.2 and involves insufficient validation of the 'service_id' parameter, which is user-controlled. Attackers can exploit this via the params[booking][service_id] parameter in the steps__load_step function and the presets[selected_service] parameter in steps__start, both accessible without authentication. This allows unauthorized creation of bookings for services that should be restricted to admins and agents, bypassing intended authorization controls.

The vulnerability allows unauthenticated attackers to bypass authorization controls and create approved bookings for admin- or agent-only services. This can lead to unauthorized consumption of restricted appointment capacity and potential disruption of service availability for legitimate users. There is no direct confidentiality or availability impact reported, but integrity is affected due to unauthorized booking creation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict public access to booking endpoints if possible or implement additional access controls to validate service_id parameters. Monitor for updates from the LatePoint vendor regarding an official fix.