CVE-2026-105257lowCWE-639

CVE-2026-105257: fallo de gravedad baja en Appointment Booking Plugin

LatePoint < 5.7.5 - Agent+ Customer PII Disclosure via IDOR

Publicada el

Seguir esta CVE+ Monitorear Appointment Booking Plugin

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

28Vexday Risk Score

Sin señal de explotación. Ella tiene prueba de concepto pública.

ssvc Attendcvss 2.7epss 0.3%
The Appointment Booking Plugin WordPress plugin before 5.7.5 does not verify that an authenticated agent-level user is assigned to a customer before returning or searching that customer's record, allowing any agent to read and enumerate the personal information of every customer on the site, including those managed by other agents.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
Productos afectados
Unknown · Appointment Booking Plugin
⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
CVEs relacionadas — Appointment Booking Plugin

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-15250MEDIUMLatePoint < 5.6.8 - Unauthenticated Booking Object Mass Assignment via Public Booking FunnelEPSS 0.3%CVE-2026-105198MEDIUMLatePoint < 5.7.3 - Unauthenticated Customer PII Disclosure via IDOREPSS 0.2%CVE-2026-105258LOWLatePoint < 5.7.6 - Admin+ Stored XSS via Booking Form Step SettingsEPSS 0.2%CVE-2026-105197LOWLatePoint < 5.6.5 - Agent+ Arbitrary Order, Customer and Transaction Deletion via IDOREPSS 0.2%CVE-2026-11866MEDIUMLatePoint < 5.6.3 - Multiple Privileged Actions via CSRFEPSS 0.1%CVE-2026-105196LOWLatePoint < 5.6.9 - Agent+ Cross-Agent Data Disclosure and Modification via Abilities APIEPSS 0.1%