CVE-2026-13471mediumCWE-639

CVE-2026-13471: falha de média gravidade em latepoint Appointment Booking Plugin…

LatePoint <= 5.6.3 - Authenticated (Custom+) Insecure Direct Object Reference to Arbitrary Booking Deletion and Customer/Booking Data Disclosure via Abilities REST API (list-bookings, list-customers, delete-booking)

Publicada em

Seguir esta CVE+ Monitorar Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 4.3epss 0.5%
The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.6.3 via the LatePointAbilityDeleteBooking::execute due to missing validation on a user controlled key. This makes it possible for attackers, with LatePoint Agent-level access and above, to read bookings and customer PII (full name, email, phone, and notes) assigned to other LatePoint agents, and delete arbitrary bookings by supplying any booking ID. This vulnerability is only exploitable when an administrator has enabled the Abilities API toggles (latepoint_abilities_api, latepoint_abilities_api_delete, and/or latepoint_abilities_api_edit) in the plugin settings.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Produtos afetados
latepoint · Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress
CVEs relacionadas — latepoint Appointment Booking Plugin…

No mesmo produto, das mais perigosas para as menos.

CVE-2026-92966CRITICALAppointment Booking Plugin <= 5.7.0 - Unauthenticated Arbitrary Shortcode Execution via First/Last Name FieldEPSS 0.7%CVE-2026-103366HIGHAppointment Booking Plugin <= 5.7.3 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'booking[id]' and 'cart[id]' ParametersEPSS 0.5%CVE-2026-100163HIGHAppointment Booking Plugin <= 5.7.2 - Unauthenticated Authentication Bypass to Customer Account Takeover via Insufficient Verification in create_wp_user_for_customer() username_exists FallbackEPSS 0.4%CVE-2026-18441MEDIUMLatePoint - Appointment Booking & Scheduling <= 5.6.9 - Unauthenticated Insecure Direct Object Reference to Sensitive Information Disclosure via 'customer[id]' ParameterEPSS 0.4%CVE-2026-110653CRITICALAppointment Booking Plugin <= 5.7.4 - Unauthenticated Authentication Bypass via Race Condition on OTP Attempts CounterEPSS 0.4%CVE-2026-96662HIGHAppointment Booking Plugin <= 5.7.2 - Unauthenticated SQL Injection via 'booking[service_id]' ParameterEPSS 0.4%