CVE-2026-94432 describes an IDOR vulnerability in the LatePoint WordPress plugin (up to version 5.7.1) within the OsPaypalConnectController::create_order_for_transaction() action. This action is exposed as a public unauthenticated AJAX route (wp_ajax_nopriv_latepoint_route_call) that loads OsInvoiceModel objects by sequential integer invoice IDs without verifying ownership or requiring an access key, unlike other payment handlers that use a 128-bit UUID. Attackers can enumerate invoices, create unauthorized transaction intents tied to other customers' invoices, and overwrite the intent_key of new transaction intents. This invalidates the intent_key expected by legitimate Stripe and Razorpay payment flows, breaking payment webhooks for affected customers.

The vulnerability allows unauthenticated attackers to enumerate invoices belonging to arbitrary customers and create or overwrite transaction intents linked to those invoices. This can disrupt legitimate payment processing by invalidating transaction intent keys, causing payment webhooks to fail. There is no direct confidentiality or availability impact reported, but integrity of payment transaction intents is compromised.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the vulnerable AJAX route if possible or monitor for suspicious activity related to invoice enumeration and transaction intent creation. Avoid relying solely on the PayPal-configured guard as it is reached too late in the process.