CVE-2026-18441mediumCWE-639

CVE-2026-18441: falha de média gravidade em latepoint Appointment Booking Plugin…

LatePoint - Appointment Booking & Scheduling <= 5.6.9 - Unauthenticated Insecure Direct Object Reference to Sensitive Information Disclosure via 'customer[id]' Parameter

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 4.3epss 0.4%
The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.6.9 via the set_customer_object due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to enumerate arbitrary customer records and disclose personally identifiable information - including first name, last name, email address, and phone number - by iterating the customer[id] parameter. This issue is exploitable only when the site is configured with customer authentication disabled (guest checkout enabled).
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Produtos afetados
latepoint · Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress
CVEs relacionadas — latepoint Appointment Booking Plugin…

No mesmo produto, das mais perigosas para as menos.

CVE-2026-92966CRITICALAppointment Booking Plugin <= 5.7.0 - Unauthenticated Arbitrary Shortcode Execution via First/Last Name FieldEPSS 0.7%CVE-2026-103366HIGHAppointment Booking Plugin <= 5.7.3 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'booking[id]' and 'cart[id]' ParametersEPSS 0.5%CVE-2026-13471MEDIUMLatePoint <= 5.6.3 - Authenticated (Custom+) Insecure Direct Object Reference to Arbitrary Booking Deletion and Customer/Booking Data Disclosure via Abilities REST API (list-bookings, list-customers, delete-booking)EPSS 0.5%CVE-2026-100163HIGHAppointment Booking Plugin <= 5.7.2 - Unauthenticated Authentication Bypass to Customer Account Takeover via Insufficient Verification in create_wp_user_for_customer() username_exists FallbackEPSS 0.4%CVE-2026-110653CRITICALAppointment Booking Plugin <= 5.7.4 - Unauthenticated Authentication Bypass via Race Condition on OTP Attempts CounterEPSS 0.4%CVE-2026-96662HIGHAppointment Booking Plugin <= 5.7.2 - Unauthenticated SQL Injection via 'booking[service_id]' ParameterEPSS 0.4%