CVE-2026-105197: fallo de gravedad baja en Appointment Booking Plugin
LatePoint < 5.6.5 - Agent+ Arbitrary Order, Customer and Transaction Deletion via IDOR
Publicada el
5Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 2.7
probabilidad de explotación
—
explotación observada
noninguna fuente lo reporta
The Appointment Booking Plugin WordPress plugin before 5.6.5 does not verify that a backend staff user is authorized to act on the specific record targeted for deletion, allowing an authenticated user with a record-scoped staff role to irreversibly delete any order, customer, or transaction on the site, including records belonging to other staff and outside their assigned scope.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
Productos afectados
Unknown · Appointment Booking PluginCVEs relacionadas — Appointment Booking Plugin
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-15250MEDIUMLatePoint < 5.6.8 - Unauthenticated Booking Object Mass Assignment via Public Booking FunnelEPSS 0.3%CVE-2026-11866MEDIUMLatePoint < 5.6.3 - Multiple Privileged Actions via CSRFEPSS 0.1%CVE-2026-105198MEDIUMLatePoint < 5.7.3 - Unauthenticated Customer PII Disclosure via IDOREPSS —CVE-2026-105196LOWLatePoint < 5.6.9 - Agent+ Cross-Agent Data Disclosure and Modification via Abilities APIEPSS —