The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Insecure Direct Object… (CVE-2026-91050)

The vulnerability in LatePoint plugin arises from insufficient authorization validation in the publicly accessible steps__start and steps__load_step routes. These routes accept a parameter presets[order_item_id] which is directly copied into the booking object without verifying ownership, payment status, or capacity. The is_bundle_scheduling() function only checks for the presence of order_item_id, bypassing proper validation. Consequently, unauthenticated attackers can create appointments on behalf of other customers and retrieve their personal data included in booking confirmations.

An attacker can create approved appointments tied to other customers' order items without authentication, leading to unauthorized booking creation. Additionally, the attacker can read sensitive customer information such as names, email addresses, and order codes from booking confirmations. The vulnerability does not impact confidentiality of the booking system itself but leaks personal data and allows unauthorized booking manipulation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected routes if possible and monitor for suspicious booking activity. Avoid exposing the vulnerable parameters publicly and consider implementing custom authorization checks as a temporary measure.