CVE-2026-103366: latepoint appointment booking plugin – latepoint | calendar & scheduling for wordpress

Vulnerability summary

CVE-2026-103366 is a high (CVSS 7.5) vulnerability in latepoint appointment booking plugin – latepoint | calendar & scheduling for wordpress. EPSS estimates a 0.47% chance of exploitation in the next 30 days, higher than 40% of scored vulnerabilities. Fixed in 5.7.4.

Timeline

1. 14-10-2026
   PublishedVulnerability first disclosed.
2. 15-10-2026
   Last modifiedVulnerability information updated.

Description

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 5.7.3 via the `booking[id]` and `cart[id]` parameters on the `steps__reload_booking_form_summary_panel` and `steps__start` public routes (reachable through wp_ajax_nopriv_latepoint_route_call). This is due to `OsStepsHelper::set_required_objects()` feeding raw request parameters into `set_booking_object()` and `set_cart_object()`, which call `OsModel::set_data()` and load an arbitrary booking or cart row by primary key with no ownership check — the ownership guard the vendor added for the earlier disclosure lives only inside `OsStepsHelper::load_step()` and does not cover the sibling routes or `cart[id]` at all. This makes it possible for unauthenticated attackers to enumerate sequential booking / cart identifiers and read other customers' appointment details (service name, agent, date/time, duration, price breakdown, status) and other shoppers' pending checkout contents directly from the JSON responses.

• CWE-639Authorization Bypass Through User-Controlled KeyThe system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.