CVE-2026-105196: falha de baixa gravidade em Appointment Booking Plugin
LatePoint < 5.6.9 - Agent+ Cross-Agent Data Disclosure and Modification via Abilities API
Publicada em
5Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 3.3
probabilidade de exploração
—
exploração observada
nãonenhuma fonte reporta
The Appointment Booking Plugin WordPress plugin before 5.6.9 does not enforce per-record authorization on several of its AI Abilities API actions, allowing an authenticated user holding the LatePoint Agent role, normally restricted to their own records, to read and modify other agents' profile data and read other agents' bookings and associated customer details when the Abilities API feature is enabled.
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N
Produtos afetados
Unknown · Appointment Booking PluginCVEs relacionadas — Appointment Booking Plugin
No mesmo produto, das mais perigosas para as menos.
CVE-2026-15250MEDIUMLatePoint < 5.6.8 - Unauthenticated Booking Object Mass Assignment via Public Booking FunnelEPSS 0.3%CVE-2026-11866MEDIUMLatePoint < 5.6.3 - Multiple Privileged Actions via CSRFEPSS 0.1%CVE-2026-105198MEDIUMLatePoint < 5.7.3 - Unauthenticated Customer PII Disclosure via IDOREPSS —CVE-2026-105197LOWLatePoint < 5.6.5 - Agent+ Arbitrary Order, Customer and Transaction Deletion via IDOREPSS —