CVE-2026-17538: latepoint appointment booking plugin – latepoint | calendar & scheduling for wordpress

Vulnerability summary

CVE-2026-17538 is a medium (CVSS 5.4) vulnerability in latepoint appointment booking plugin – latepoint | calendar & scheduling for wordpress. EPSS estimates a 0.15% chance of exploitation in the next 30 days, higher than 3.9% of scored vulnerabilities. Fixed in 5.6.10.

Timeline

1. 07-10-2026
   PublishedVulnerability first disclosed.
2. 10-10-2026
   Last modifiedVulnerability information updated.

Description

The LatePoint - Appointment Booking & Reservation plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 5.6.9. This is due to the process_step_customer() function using is_user_logged_in() as the sole gate before merging POSTed customer data into an existing LatePoint customer, without any ownership checks. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify the personal information (first name, last name, email, phone, notes) of arbitrary LatePoint customers, and, when the contact_merge setting is 'phone', to overwrite the victim's email address and take over the account via a password reset.

• CWE-639Authorization Bypass Through User-Controlled KeyThe system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.