LatePoint <= 5.7.2 - Unauthenticated Insecure Direct Object Reference to Payment Bypass and Customer Information Disclosure via 'order_item_id' Parameter

ID

WPSEC-2026-0286

Plugin

Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress (latepoint)

Affected

all versions before 5.7.3

Remediation

Update to 5.7.3 or later.

CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Weakness

CWE-639

Usage

Plugin Medium · Affected versions Low among sites WPSec scans, 2026-10-22

Attack surface

LatePoint on WPSec AttackSurface

Fix released

2026-09-29

Published

2026-10-02

Description

The LatePoint plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.7.2. This is due to the public booking form accepting a client-supplied order_item_id (through the booking[order_item_id] field or the order_item_id preset) without verifying that the order item belongs to the current customer. Supplying an order item ID switches the booking into bundle-scheduling mode, which skips the payment steps and saves the booking directly against that order item. This makes it possible for unauthenticated attackers, who can register as a customer within the same booking form, to book appointments without paying, consume bundle sessions purchased by other customers, and view the bundle owner's name and email address or phone number on the confirmation screen.

References

• https://wpsec.com/vuln/WPSEC-2026-0286/
• https://plugins.svn.wordpress.org/latepoint/tags/5.7.3/
• https://wordpress.org/plugins/latepoint/

Published by WPSec. Provided as is, without warranty. Corrections: contact us.

This advisory as JSON or Markdown · All advisories: JSON, RSS