CVE-2026-9719
Deferred Deferred - Pending Action
Cross-Site Request Forgery in LatePoint WordPress Plugin

Publication date: 2026-06-06

Last updated on: 2026-06-08

Assigner: Wordfence

Description
The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.6.0. This is due to missing or incorrect nonce validation on the change_status function. This makes it possible for unauthenticated attackers to change the status of arbitrary invoices — including marking unpaid invoices as paid — without administrator consent via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-06-06
Last Modified
2026-06-08
Generated
2026-06-27
AI Q&A
2026-06-07
EPSS Evaluated
2026-06-25
NVD
CVE-2026-9719
EUVD
EUVD-2026-34929
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
latepoint calendar_booking_plugin to 5.6.0 (inc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-352 The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Mitigation Strategies

To mitigate this vulnerability, you should update the LatePoint – Calendar Booking Plugin for WordPress to a version later than 5.6.0 where the nonce validation issue in the change_status function is fixed.

Additionally, avoid clicking on suspicious links and ensure that site administrators are aware of the risk of Cross-Site Request Forgery attacks.

Executive Summary

The vulnerability exists in the LatePoint – Calendar Booking Plugin for WordPress, specifically in versions up to and including 5.6.0. It is a Cross-Site Request Forgery (CSRF) issue caused by missing or incorrect nonce validation in the change_status function.

This flaw allows unauthenticated attackers to trick a site administrator into performing actions such as clicking a malicious link, which then changes the status of arbitrary invoices without the administrator's consent.

For example, attackers can mark unpaid invoices as paid by exploiting this vulnerability.

Impact Analysis

This vulnerability can lead to unauthorized changes in invoice statuses, such as marking unpaid invoices as paid without proper authorization.

Such unauthorized changes can result in financial discrepancies, loss of revenue, and potential trust issues with customers or clients.

Since the attack requires tricking an administrator into performing an action, it can also lead to broader security concerns related to social engineering.

Compliance Impact

The vulnerability allows unauthenticated attackers to change the status of arbitrary invoices, including marking unpaid invoices as paid, without administrator consent. This unauthorized modification of invoice data could lead to integrity issues in financial records.

Such unauthorized changes may impact compliance with standards and regulations that require accurate and tamper-proof financial and transactional records, such as GDPR and HIPAA, especially if invoice data is considered personal or sensitive information.

However, the provided information does not explicitly state the direct impact on compliance with these regulations.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-9719. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart