CVE-2026-103366

Received Received - Intake

Insecure Direct Object Reference in LatePoint WordPress Plugin

Publication date: 2026-10-14

Last updated on: 2026-10-15

Assigner: Wordfence

Description

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 5.7.3 via the `booking[id]` and `cart[id]` parameters on the `steps__reload_booking_form_summary_panel` and `steps__start` public routes (reachable through wp_ajax_nopriv_latepoint_route_call). This is due to `OsStepsHelper::set_required_objects()` feeding raw request parameters into `set_booking_object()` and `set_cart_object()`, which call `OsModel::set_data()` and load an arbitrary booking or cart row by primary key with no ownership check — the ownership guard the vendor added for the earlier disclosure lives only inside `OsStepsHelper::load_step()` and does not cover the sibling routes or `cart[id]` at all. This makes it possible for unauthenticated attackers to enumerate sequential booking / cart identifiers and read other customers' appointment details (service name, agent, date/time, duration, price breakdown, status) and other shoppers' pending checkout contents directly from the JSON responses.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-103366

EUVD

EUVD-2026-100901

Affected Vendors & Products

Vendor	Product	Version / Range
latepoint	Appointment	Booking Plugin – LatePoint \| Calendar & Scheduling for WordPress 0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

This vulnerability is an Insecure Direct Object Reference (IDOR) in the Appointment Booking Plugin for WordPress. It allows unauthenticated attackers to access other users' appointment details and pending checkout contents by manipulating parameters like booking[id] and cart[id]. The flaw exists because the plugin fails to properly check ownership of these objects before loading them.

Detection Guidance

Check for unauthorized access to booking or cart data via the vulnerable parameters. Monitor logs for requests to wp_ajax_nopriv_latepoint_route_call with booking[id] or cart[id] parameters. Use tools like curl to test if responses expose sensitive data from other users.

Impact Analysis

If you use this plugin, attackers could read sensitive appointment information such as service names, agent details, dates, times, prices, and customer statuses. They could also view other users' pending checkout cart contents, potentially exposing personal or payment-related data.

Compliance Impact

This vulnerability likely violates GDPR and HIPAA by exposing personal and sensitive data without authorization. GDPR requires protecting personal data, while HIPAA mandates safeguarding health-related information. Unauthorized access to such data could lead to legal penalties and reputational damage.

Mitigation Strategies

Update the LatePoint plugin to the latest version if available. Temporarily disable the plugin if no update exists. Restrict access to wp_ajax_nopriv_latepoint_route_call endpoints. Monitor for unusual data access patterns.

Hi! I’m here to help you understand CVE-2026-103366. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70