CVE-2026-18441

Overview

The LatePoint Appointment Booking plugin for WordPress (v5.6.9 and earlier) contains an insecure direct object reference that allows unauthenticated users to enumerate customer records when guest checkout is enabled. Attackers can retrieve first name, last name, email, and phone number for any customer ID. This flaw exposes personally identifiable information without requiring authentication.

Description

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.6.9 via the set_customer_object due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to enumerate arbitrary customer records and disclose personally identifiable information - including first name, last name, email address, and phone number - by iterating the customer[id] parameter. This issue is exploitable only when the site is configured with customer authentication disabled (guest checkout enabled).

Impact

Confidentiality is compromised as attackers can view PII of all customers. Integrity and availability are not directly affected. Site owners and their customers are the primary victims, with potential legal and reputational consequences.

Remediation

['Upgrade LatePoint to the latest version (≥5.7.0) where the IDOR is fixed.', 'If an upgrade is not possible, disable guest checkout or enable customer authentication to block unauthenticated access.', 'Implement server‑side validation to ensure the customer ID belongs to the requesting user or is otherwise authorized.', 'Apply the principle of least privilege by restricting API endpoints to authenticated users only.']

Risk context

The vulnerability has a medium CVSS v3 score (4.3) and no EPSS data is available. While it does not allow remote code execution, the exposure of PII is significant for privacy compliance. Defenders should act promptly to patch or mitigate.

Affected products

• LatePoint Calendar & Scheduling for WordPress
• WordPress