CVE-2026-5234 is an authorization bypass vulnerability in the LatePoint – Calendar Booking Plugin for WordPress, specifically affecting versions up to 5.3.2. The vulnerability arises because the OsStripeConnectController::create_payment_intent_for_transaction action is registered as a public action without requiring authentication or ownership verification. It loads invoices by sequential integer invoice_id, unlike other invoice actions that require a cryptographic UUID access key. This flaw enables unauthenticated attackers to enumerate valid invoice IDs through error messages and create unauthorized transaction intent records containing sensitive financial information. On sites configured with Stripe Connect, the vulnerability additionally leaks Stripe payment_intent_client_secret tokens and transaction_intent_key values, exposing payment amounts and potentially sensitive transaction data. The vulnerability is classified under CWE-639 (Authorization Bypass Through User-Controlled Key) and has a CVSS 3.1 score of 5.3, indicating medium severity. No patch or official remediation has been disclosed at this time.

An unauthenticated attacker can enumerate valid invoice IDs and create unauthorized transaction intent records in the database, exposing sensitive financial data such as invoice IDs, order IDs, customer IDs, charge amounts, and Stripe payment intent client secrets. This could lead to unauthorized access to payment-related information and potential misuse of Stripe payment tokens. The vulnerability does not impact confidentiality of the entire system but leaks sensitive transaction data, which may facilitate further attacks or fraud.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict public access to the OsStripeConnectController::create_payment_intent_for_transaction action if possible, or disable the plugin if feasible. Monitor for updates from the LatePoint vendor and apply patches promptly once available.