CVE-2026-11866: falha de média gravidade em Appointment Booking Plugin
LatePoint < 5.6.3 - Multiple Privileged Actions via CSRF
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
33Vexday Risk Score
Sem sinal de exploração. Ela tem prova de conceito pública.
ssvc Attendcvss 5.4epss 0.1%
The Appointment Booking Plugin WordPress plugin before 5.6.3 does not validate a CSRF nonce on several state-changing actions handled by its central request dispatcher, allowing attackers to perform privileged actions, such as overwriting the booking-form configuration or disconnecting the connected payment gateway, via Cross-Site Request Forgery against a logged-in administrator.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
Produtos afetados
Unknown · Appointment Booking PluginPoCs públicas encontradas — 1
cve_referencewpscan.com/vulnerability/84e936b8-1978-4dc3-aa40-5ce49bfdc445/não verificado⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.
CVEs relacionadas — Appointment Booking Plugin
No mesmo produto, das mais perigosas para as menos.
CVE-2026-15250MEDIUMLatePoint < 5.6.8 - Unauthenticated Booking Object Mass Assignment via Public Booking FunnelEPSS 0.3%CVE-2026-105257LOWLatePoint < 5.7.5 - Agent+ Customer PII Disclosure via IDOREPSS 0.3%CVE-2026-105198MEDIUMLatePoint < 5.7.3 - Unauthenticated Customer PII Disclosure via IDOREPSS 0.2%CVE-2026-105258LOWLatePoint < 5.7.6 - Admin+ Stored XSS via Booking Form Step SettingsEPSS 0.2%CVE-2026-105197LOWLatePoint < 5.6.5 - Agent+ Arbitrary Order, Customer and Transaction Deletion via IDOREPSS 0.2%CVE-2026-105196LOWLatePoint < 5.6.9 - Agent+ Cross-Agent Data Disclosure and Modification via Abilities APIEPSS 0.1%