CVE-2026-92966: CWE-94 Improper Control of Generation of Code ('Code Injection') in latepoint Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress
The Appointment Booking Plugin – LatePoint for WordPress versions up to and including 5.7.0 contains a critical vulnerability allowing unauthenticated attackers to execute arbitrary shortcodes. This occurs because the plugin improperly validates input before passing it to WordPress's do_shortcode function, enabling code injection during the booking flow. The vulnerability can lead to full compromise of confidentiality and integrity without requiring user interaction.
AI Analysis
Technical Summary
CVE-2026-92966 is a code injection vulnerability (CWE-94) in the LatePoint Appointment Booking Plugin for WordPress. The flaw exists in all versions up to 5.7.0, where an unauthenticated attacker can inject arbitrary shortcodes during the booking process. These shortcodes are stored and later executed when the Customer Cabinet block renders the stored name, triggering WordPress's do_shortcode filter. This improper validation allows execution of arbitrary code within the WordPress context, leading to high impact on confidentiality and integrity.
Potential Impact
An unauthenticated attacker can execute arbitrary shortcodes, resulting in full compromise of confidentiality and integrity of the affected WordPress site. Availability is not impacted. The vulnerability has a CVSS 3.1 score of 9.1 (critical), reflecting its ease of exploitation and severe impact.
Mitigation Recommendations
No official patch or fix information is provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the booking functionality or disable the plugin to prevent exploitation.
CVE-2026-92966: CWE-94 Improper Control of Generation of Code ('Code Injection') in latepoint Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress
Description
The Appointment Booking Plugin – LatePoint for WordPress versions up to and including 5.7.0 contains a critical vulnerability allowing unauthenticated attackers to execute arbitrary shortcodes. This occurs because the plugin improperly validates input before passing it to WordPress's do_shortcode function, enabling code injection during the booking flow. The vulnerability can lead to full compromise of confidentiality and integrity without requiring user interaction.
CVSS v3.1
Score 9.1critical
Affected software
latepoint
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-92966 is a code injection vulnerability (CWE-94) in the LatePoint Appointment Booking Plugin for WordPress. The flaw exists in all versions up to 5.7.0, where an unauthenticated attacker can inject arbitrary shortcodes during the booking process. These shortcodes are stored and later executed when the Customer Cabinet block renders the stored name, triggering WordPress's do_shortcode filter. This improper validation allows execution of arbitrary code within the WordPress context, leading to high impact on confidentiality and integrity.
Potential Impact
An unauthenticated attacker can execute arbitrary shortcodes, resulting in full compromise of confidentiality and integrity of the affected WordPress site. Availability is not impacted. The vulnerability has a CVSS 3.1 score of 9.1 (critical), reflecting its ease of exploitation and severe impact.
Mitigation Recommendations
No official patch or fix information is provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the booking functionality or disable the plugin to prevent exploitation.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Wordfence
- Date Reserved
- 2026-09-17T13:10:34.409Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6abde6202a4e24523d5e1cff
Added to database: 10/01/2026, 04:48:32 UTC
Last enriched: 10/01/2026, 05:02:54 UTC
Last updated: 10/01/2026, 05:05:14 UTC
Views: 6
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.