The LatePoint – Calendar Booking Plugin for WordPress suffers from a missing capability check in the load_step() function in versions up to and including 5.2.6. This missing authorization (CWE-862) enables unauthenticated remote attackers to retrieve booking data without proper permissions. The vulnerability has a CVSS 3.1 base score of 5.3, reflecting its network accessibility and impact limited to confidentiality loss of customer booking information. There is no indication of integrity or availability impact. No patch or official fix information is available at this time.

An unauthenticated attacker can access sensitive customer booking information including names, email addresses, phone numbers, appointment times, and service details. This exposure compromises customer privacy and could facilitate further social engineering or targeted attacks. There is no evidence of impact on data integrity or system availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the plugin's booking data endpoints where possible, such as by limiting public access or using web application firewall rules to block unauthorized requests. Monitor for vendor updates and apply patches promptly once available.