CVE-2026-96662: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in latepoint Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress

CVE-2026-96662 is an SQL Injection vulnerability in the Appointment Booking Plugin – LatePoint for WordPress. It affects all versions up to and including 5.7.2. The flaw arises from improper neutralization of special elements in the 'booking[service_id]' parameter, allowing unauthenticated attackers to append malicious SQL commands to existing queries. This occurs due to insufficient escaping of user input and lack of prepared statements, enabling extraction of sensitive information from the database.

An unauthenticated attacker can exploit this vulnerability to perform SQL Injection attacks, potentially extracting sensitive information from the database. The vulnerability does not affect integrity or availability directly but compromises confidentiality. The CVSS 3.1 score is 7.5 (high severity), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling the vulnerable plugin or restricting access to the affected parameter. Monitor vendor channels for updates and apply patches promptly once released.