CVE-2026-105257: low-severity vulnerability in Appointment Booking Plugin
LatePoint < 5.7.5 - Agent+ Customer PII Disclosure via IDOR
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
28Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 2.7epss 0.3%
The Appointment Booking Plugin WordPress plugin before 5.7.5 does not verify that an authenticated agent-level user is assigned to a customer before returning or searching that customer's record, allowing any agent to read and enumerate the personal information of every customer on the site, including those managed by other agents.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
Affected products
Unknown · Appointment Booking Pluginpublic PoCs found — 1
cve_referencewpscan.com/vulnerability/10a8f09f-8282-456d-ad07-7e594e70a371/unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Appointment Booking Plugin
In the same product, most dangerous first.
CVE-2026-15250MEDIUMLatePoint < 5.6.8 - Unauthenticated Booking Object Mass Assignment via Public Booking FunnelEPSS 0.3%CVE-2026-105198MEDIUMLatePoint < 5.7.3 - Unauthenticated Customer PII Disclosure via IDOREPSS 0.2%CVE-2026-105258LOWLatePoint < 5.7.6 - Admin+ Stored XSS via Booking Form Step SettingsEPSS 0.2%CVE-2026-105197LOWLatePoint < 5.6.5 - Agent+ Arbitrary Order, Customer and Transaction Deletion via IDOREPSS 0.2%CVE-2026-11866MEDIUMLatePoint < 5.6.3 - Multiple Privileged Actions via CSRFEPSS 0.1%CVE-2026-105196LOWLatePoint < 5.6.9 - Agent+ Cross-Agent Data Disclosure and Modification via Abilities APIEPSS 0.1%