The LatePoint Appointment Booking Plugin for WordPress versions up to 5.6.3 contains an Insecure Direct Object Reference (IDOR) vulnerability (CWE-639) in the LatePointAbilityDeleteBooking::execute function. This flaw arises from missing validation on a user-controlled key, enabling attackers with Agent-level privileges or above to access bookings and customer PII (full name, email, phone, notes) belonging to other agents and delete bookings arbitrarily. Exploitation requires that the administrator has enabled the Abilities API toggles (latepoint_abilities_api, latepoint_abilities_api_delete, and/or latepoint_abilities_api_edit).

An attacker with Agent-level access can bypass authorization controls to read sensitive customer data assigned to other agents and delete bookings without proper permission. This leads to unauthorized disclosure of personally identifiable information and potential disruption of booking data integrity. The vulnerability does not allow privilege escalation beyond Agent-level access and does not impact availability or confidentiality beyond the described scope.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should consider disabling the Abilities API toggles (latepoint_abilities_api, latepoint_abilities_api_delete, latepoint_abilities_api_edit) to prevent exploitation. Restrict Agent-level access carefully and monitor for unauthorized booking deletions or access.