CVE-2026-94432 is an authorization bypass vulnerability (CWE-639) in the LatePoint Appointment Booking Plugin for WordPress, affecting versions up to and including 5.7.1. The vulnerability exists in the OsPaypalConnectController::create_order_for_transaction() action, which is exposed as a public unauthenticated AJAX route. This handler loads invoice data by a sequential integer invoice_id without verifying ownership or requiring an access key, unlike sibling Stripe and Razorpay handlers that require a 128-bit UUID access key. Attackers can enumerate invoices belonging to other customers, create unauthorized transaction intent records linked to those customers, and overwrite the intent_key of in-flight transactions. This invalidates the intent_key expected by legitimate payment flows, potentially breaking payment webhook processing.

The vulnerability allows unauthenticated attackers to enumerate invoices of arbitrary customers and create or overwrite transaction intents linked to other customers' data. This can disrupt payment processing by invalidating transaction intent keys, potentially causing payment webhooks for affected customers to fail. There is no direct confidentiality or availability impact reported, but the integrity of payment transactions is affected.

No official patch or fix is currently confirmed for this vulnerability. Users should monitor the vendor's advisory for updates. Until a fix is available, consider restricting access to the vulnerable AJAX endpoint or implementing custom access controls to prevent unauthorized invoice enumeration and transaction intent creation.