CVE-2026-9719
Cross-Site Request Forgery in LatePoint WordPress Plugin
Publication date: 2026-06-06
Last updated on: 2026-06-06
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| latepoint | calendar_booking_plugin | to 5.6.0 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-352 | The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows unauthenticated attackers to change the status of arbitrary invoices, including marking unpaid invoices as paid, without administrator consent. This unauthorized modification of invoice data could lead to integrity issues in financial records.
Such unauthorized changes may impact compliance with standards and regulations that require accurate and tamper-proof financial and transactional records, such as GDPR and HIPAA, especially if invoice data is considered personal or sensitive information.
However, the provided information does not explicitly state the direct impact on compliance with these regulations.
Can you explain this vulnerability to me?
The vulnerability exists in the LatePoint – Calendar Booking Plugin for WordPress, specifically in versions up to and including 5.6.0. It is a Cross-Site Request Forgery (CSRF) issue caused by missing or incorrect nonce validation in the change_status function.
This flaw allows unauthenticated attackers to trick a site administrator into performing actions such as clicking a malicious link, which then changes the status of arbitrary invoices without the administrator's consent.
For example, attackers can mark unpaid invoices as paid by exploiting this vulnerability.
How can this vulnerability impact me? :
This vulnerability can lead to unauthorized changes in invoice statuses, such as marking unpaid invoices as paid without proper authorization.
Such unauthorized changes can result in financial discrepancies, loss of revenue, and potential trust issues with customers or clients.
Since the attack requires tricking an administrator into performing an action, it can also lead to broader security concerns related to social engineering.