The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to generic SQL Injection via… (CVE-2026-96662)

CVE-2026-96662 describes a generic SQL Injection vulnerability in the Appointment Booking Plugin – LatePoint for WordPress. The flaw exists in the handling of the 'booking[service_id]' parameter, where user input is not properly escaped or prepared before being included in SQL queries. This enables unauthenticated attackers to append additional SQL commands to existing queries, potentially extracting sensitive data from the backend database. The vulnerability affects all plugin versions up to and including 5.7.2.

Successful exploitation can result in unauthorized disclosure of sensitive information from the database. The vulnerability does not require authentication and has a low attack complexity, increasing the risk of exploitation. However, there is no indication of integrity or availability impact. No known exploits in the wild have been reported to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling the plugin or restricting access to vulnerable endpoints. Monitor vendor channels for updates regarding patches or official mitigations.