CVE-2026-18441mediumCWE-639

CVE-2026-18441: medium-severity vulnerability in latepoint Appointment Booking Plugin…

LatePoint - Appointment Booking & Scheduling <= 5.6.9 - Unauthenticated Insecure Direct Object Reference to Sensitive Information Disclosure via 'customer[id]' Parameter

Published · Updated

Follow this CVE+ Monitor Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 4.3epss 0.4%
The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.6.9 via the set_customer_object due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to enumerate arbitrary customer records and disclose personally identifiable information - including first name, last name, email address, and phone number - by iterating the customer[id] parameter. This issue is exploitable only when the site is configured with customer authentication disabled (guest checkout enabled).
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Affected products
latepoint · Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress
Related CVEs — latepoint Appointment Booking Plugin…

In the same product, most dangerous first.

CVE-2026-92966CRITICALAppointment Booking Plugin <= 5.7.0 - Unauthenticated Arbitrary Shortcode Execution via First/Last Name FieldEPSS 0.7%CVE-2026-103366HIGHAppointment Booking Plugin <= 5.7.3 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'booking[id]' and 'cart[id]' ParametersEPSS 0.5%CVE-2026-13471MEDIUMLatePoint <= 5.6.3 - Authenticated (Custom+) Insecure Direct Object Reference to Arbitrary Booking Deletion and Customer/Booking Data Disclosure via Abilities REST API (list-bookings, list-customers, delete-booking)EPSS 0.5%CVE-2026-100163HIGHAppointment Booking Plugin <= 5.7.2 - Unauthenticated Authentication Bypass to Customer Account Takeover via Insufficient Verification in create_wp_user_for_customer() username_exists FallbackEPSS 0.4%CVE-2026-110653CRITICALAppointment Booking Plugin <= 5.7.4 - Unauthenticated Authentication Bypass via Race Condition on OTP Attempts CounterEPSS 0.4%CVE-2026-96662HIGHAppointment Booking Plugin <= 5.7.2 - Unauthenticated SQL Injection via 'booking[service_id]' ParameterEPSS 0.4%