CVE-2026-5234 is an authorization bypass vulnerability in the LatePoint WordPress plugin for calendar bookings, caused by the OsStripeConnectController::create_payment_intent_for_transaction action being publicly accessible without authentication or ownership verification. This allows attackers to enumerate invoice IDs and create unauthorized transaction intents with sensitive data including invoice_id, order_id, customer_id, charge_amount, and Stripe payment_intent_client_secret tokens. The vulnerability contrasts with other invoice actions that require cryptographic UUID access keys, indicating inconsistent access control implementation.

An unauthenticated attacker can enumerate valid invoice IDs and create unauthorized transaction intent records containing sensitive financial information. On sites configured with Stripe Connect, the vulnerability also exposes Stripe payment intent client secrets and transaction keys, potentially compromising payment security. The CVSS score of 5.3 reflects a medium severity impact primarily due to information disclosure and unauthorized transaction creation without direct system compromise or denial of service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict public access to the OsStripeConnectController::create_payment_intent_for_transaction action or implement custom access controls to verify invoice ownership and require authentication. Monitor vendor channels for updates and apply official patches promptly once released.