The Appointment Booking Plugin – LatePoint for WordPress versions up to and including 5.7.4 has a vulnerability that allows unauthenticated attackers to access sensitive customer information. This occurs via the 'params (customer[uuid])' parameter through the unauthenticated steps__load_step AJAX endpoint when the plugin is configured in guest checkout mode ('Field used for authentication' set to 'Disable ability to login'). The exposed data includes first name, last name, email address, phone number, and notes of all customer records.
The Appointment Booking Plugin – LatePoint for WordPress contains an authentication bypass vulnerability due to a race condition in the OTP verification process. Versions up to and including 5.7.4 are affected. The flaw arises from a non-atomic increment of the OTP attempts counter, allowing attackers to bypass the 10-attempt lockout by sending concurrent requests. This enables brute-forcing of the 6-digit OTP code and unauthorized access to customer accounts and data. The nonce mechanism does not prevent exploitation as it is publicly accessible. The vulnerability has a critical severity with a CVSS score of 9.1.
The Appointment Booking Plugin – LatePoint for WordPress versions up to 5.7.3 contains a vulnerability that allows authenticated users with subscriber-level access or higher to expose sensitive booking information. This occurs via the 'params[customer][first_name]' parameter, enabling attackers to extract privileged data such as admin notes, internal contact details, transaction tokens, and payment URLs through notification emails. The issue arises when a crafted placeholder is stored in the first_name field and triggers the password-reset email flow, revealing sensitive information.
The Appointment Booking Plugin – LatePoint for WordPress versions up to 5.7.3 contains an authorization bypass vulnerability due to insecure direct object references in certain public AJAX routes. Unauthenticated attackers can enumerate booking and cart IDs to access other users' appointment details and pending checkout information without ownership verification.
The Appointment Booking Plugin – LatePoint for WordPress versions up to and including 5.7.2 contains an authentication bypass vulnerability. This flaw arises when the 'Use WordPress users as customers' option is enabled, allowing attackers with Subscriber-level access to impersonate other customers by exploiting a fallback check that matches usernames to emails incorrectly. Attackers can access victim customer data and overwrite their email on next login.
The Appointment Booking Plugin – LatePoint for WordPress contains a SQL Injection vulnerability in the 'booking[service_id]' parameter. This affects all versions up to and including 5.7.2. The flaw allows unauthenticated attackers to inject additional SQL commands due to insufficient input escaping and query preparation, potentially exposing sensitive database information. The vulnerability has a high severity score of 7.5 and does not require user interaction or privileges to exploit.
The Appointment Booking Plugin – LatePoint for WordPress suffers from an improper privilege management vulnerability allowing privilege escalation. Authenticated users with the 'settings__edit' capability can manipulate the default WordPress role assigned to new customers, potentially setting it to 'administrator'. This enables newly registered LatePoint customer accounts to gain full administrator privileges. The issue affects all versions up to and including 5.7.3. Exploitation requires prior capability assignment by a WordPress administrator and subsequent new customer registration through LatePoint.
The Appointment Booking Plugin – LatePoint for WordPress versions up to 5.7.2 contains an authorization bypass vulnerability. This flaw allows unauthenticated attackers to manipulate a user-controlled parameter to create approved appointments linked to other customers' order items. The vulnerability arises because the plugin does not verify ownership, payment status, or capacity for the referenced order items. Attackers can also access personal information such as names, email addresses, and order codes of other customers. The issue is due to insufficient validation in specific routes handling booking steps.
The LatePoint Appointment Booking plugin for WordPress up to version 5.6.9 contains an authorization bypass vulnerability. Authenticated users with Subscriber-level access or higher can modify personal information of arbitrary customers due to insufficient ownership checks in the process_step_customer() function. This flaw allows attackers to change details such as first name, last name, email, phone, and notes. When the contact_merge setting is configured to 'phone', attackers can overwrite the victim's email address and potentially take over the account via password reset.
The Appointment Booking Plugin – LatePoint for WordPress versions up to 5.7.1 contains an authorization bypass vulnerability due to insecure direct object reference. This flaw allows unauthenticated attackers to enumerate invoices of arbitrary customers and create unauthorized transaction intents linked to other customers' data. The vulnerability arises because the plugin's PayPal transaction creation handler does not verify ownership or require an access key, unlike other payment handlers. Exploitation can disrupt legitimate payment flows by invalidating transaction intent keys.
The The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.7.0. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. The payload is planted during the unauthenticated booking flow and triggered when the Customer Cabinet block rendered by render_customer_dashboard() outputs the stored name into the content stream, where WordPress core's do_shortcode filter at priority 11 re-parses and executes it.
The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.6.3 via the LatePointAbilityDeleteBooking::execute due to missing validation on a user controlled key. This makes it possible for attackers, with LatePoint Agent-level access and above, to read bookings and customer PII (full name, email, phone, and notes) assigned to other LatePoint agents, and delete arbitrary bookings by supplying any booking ID. This vulnerability is only exploitable when an administrator has enabled the Abilities API toggles (latepoint_abilities_api, latepoint_abilities_api_delete, and/or latepoint_abilities_api_edit) in the plugin settings.
The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.6.9 via the set_customer_object due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to enumerate arbitrary customer records and disclose personally identifiable information - including first name, last name, email address, and phone number - by iterating the customer[id] parameter. This issue is exploitable only when the site is configured with customer authentication disabled (guest checkout enabled).
The LatePoint Appointment Booking Plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in the 'btn_wrapper_classes' attribute of the 'latepoint_resources' shortcode. This vulnerability affects all versions up to and including 5.3.2 and allows authenticated users with contributor-level access or higher to inject arbitrary scripts that execute when a page is viewed. The issue arises from insufficient input sanitization and output escaping in the 'locations' branch of the shortcode processing function.
The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Improper Input Validation in all versions up to, and including, 5.4.0. This is due to the plugin's Stripe Connect payment processor accepting a client-supplied PaymentIntent ID. This makes it possible for unauthenticated attackers to pay an arbitrary amount by supplying a previously succeeded PaymentIntent token.
The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.6.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to modify the personally identifiable information (first name, last name, phone number, and notes) of any existing customer record, including those linked to administrator accounts, by submitting the booking form with a known customer's email address. Exploitation requires the plugin to be configured with guest bookings enabled (is_customer_auth_disabled() returning true), which is necessary for the vulnerable unauthenticated code path in process_step_customer() to be reached.
The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.6.2 via the 'service_id' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to create approved bookings against services explicitly restricted to admins and agents, consuming restricted appointment capacity and triggering unauthorized bookings for admin/agent-only services. The bypass works via both the params[booking][service_id] parameter in steps__load_step and the presets[selected_service] parameter in steps__start, both of which are publicly accessible without authentication.