CVE-2026-105257

Deferred Deferred - Pending Action

Unauthorized Customer Data Exposure in Appointment Booking Plugin

Publication date: 2026-10-21

Last updated on: 2026-10-21

Assigner: WPScan

Description

The Appointment Booking Plugin WordPress plugin before 5.7.5 does not verify that an authenticated agent-level user is assigned to a customer before returning or searching that customer's record, allowing any agent to read and enumerate the personal information of every customer on the site, including those managed by other agents.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-21

Last Modified

2026-10-21

Generated

2026-11-10

AI Q&A

2026-10-22

EPSS Evaluated

2026-11-09

NVD

CVE-2026-105257

EUVD

EUVD-2026-107051

Affected Vendors & Products

Vendor	Product	Version / Range
Unknown	Appointment Booking Plugin	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

This vulnerability is an Insecure Direct Object Reference (IDOR) flaw in the Appointment Booking Plugin for WordPress. It allows authenticated agent-level users to access and enumerate personal information of all customers on the site without verifying if they are assigned to those customers. This exposes sensitive customer data.

Detection Guidance

To detect this vulnerability, check if your WordPress site uses the Appointment Booking Plugin (or LatePoint) versions prior to 5.7.5. Inspect the plugin version in the WordPress admin panel under Plugins. You can also use WPScan to scan for vulnerable versions with the command: wpscan --url <your-site-url> --enumerate vp,vt.

Impact Analysis

If you are a customer using this plugin, your personal information could be accessed by unauthorized agents. If you are a site administrator, customer data privacy is compromised, leading to potential misuse of PII and loss of trust.

Compliance Impact

This vulnerability likely violates GDPR and HIPAA due to unauthorized access to PII. GDPR requires strict data protection, and HIPAA mandates safeguards for protected health information. Non-compliance could result in legal penalties and reputational damage.

Mitigation Strategies

Immediately update the Appointment Booking Plugin (or LatePoint) to version 5.7.5 or later. If updating is not possible, consider disabling the plugin temporarily until an update is applied. Review user roles and permissions to ensure agents only access assigned customers.

Hi! I’m here to help you understand CVE-2026-105257. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...