CVE-2026-91050: CWE-639 Authorization Bypass Through User-Controlled Key in latepoint Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress

CVE-2026-91050 is an authorization bypass vulnerability (CWE-639) in the LatePoint Appointment Booking Plugin for WordPress, affecting versions up to and including 5.7.2. The issue stems from the plugin's publicly accessible routes steps__start and steps__load_step accepting a parameter presets[order_item_id] that is directly copied into the booking object without verifying if the order item belongs to the current user, is paid, or has remaining capacity. The is_bundle_scheduling() function only checks if order_item_id is non-empty, bypassing critical validation. Consequently, unauthenticated attackers can create approved appointments for other customers' order items and retrieve sensitive customer data such as names, emails, and order codes from booking confirmations.

An attacker can create unauthorized appointments linked to other customers' order items without authentication, potentially disrupting booking processes. Additionally, the attacker can access personal information of other customers, including names, email addresses, and order codes, leading to privacy violations. The vulnerability does not allow direct code execution or denial of service but compromises data integrity and confidentiality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected routes if possible and monitor for suspicious activity related to booking creation. Avoid exposing the vulnerable endpoints publicly or implement custom authorization checks to verify order item ownership and payment status.