CVE-2026-103380

Deferred Deferred - Pending Action

Appointment Booking Plugin Sensitive Data Exposure via First Name Parameter

Publication date: 2026-10-14

Last updated on: 2026-10-15

Assigner: Wordfence

Description

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.7.3 via the 'params[customer][first_name]' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract privileged booking data including the administrator-only admin_notes field, assigned agent internal contact details, transaction tokens, and payment request URLs delivered via rendered notification emails. A LatePoint customer can exploit this by storing a template placeholder such as {{customer_admin_notes}} in their own first_name field via the customer_cabinet__update route, then triggering the password-reset email flow to receive the expanded value in the resulting notification.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-103380

EUVD

EUVD-2026-100902

Affected Vendors & Products

Vendor	Product	Version / Range
latepoint	Appointment	Booking Plugin – LatePoint \| Calendar & Scheduling for WordPress 0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

Executive Summary

This vulnerability in the Appointment Booking Plugin for WordPress allows authenticated attackers with subscriber-level access or higher to expose sensitive booking data. By manipulating the 'params[customer][first_name]' parameter, they can extract privileged information such as admin-only notes, agent contact details, transaction tokens, and payment request URLs through notification emails.

Detection Guidance

Check WordPress sites running the LatePoint plugin for unauthorized access to sensitive data via the customer_cabinet__update route. Look for unusual entries in the first_name field containing template placeholders like {{customer_admin_notes}}.

Impact Analysis

If exploited, this vulnerability could lead to unauthorized access to sensitive data like administrator notes, customer payment details, and internal agent information. Attackers could misuse this data for fraud, identity theft, or further attacks on your WordPress site or users.

Compliance Impact

This vulnerability could violate GDPR by exposing personal data without consent and HIPAA by leaking protected health information if booking data includes such details. Non-compliance may result in legal penalties, fines, or reputational damage.

Mitigation Strategies

Update the LatePoint plugin to the latest version beyond 5.7.3. Remove any suspicious template placeholders in user fields. Review admin_notes and transaction data for unauthorized access.

Hi! I’m here to help you understand CVE-2026-103380. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70