Authorization Bypass in LatePoint WordPress Plugin

Executive Summary

The vulnerability exists in the LatePoint – Calendar Booking Plugin for WordPress, affecting all versions up to and including 5.6.1. It is an authorization bypass issue caused by the plugin failing to properly verify if a user is authorized to perform certain actions.

This flaw allows unauthenticated attackers to modify personally identifiable information (such as first name, last name, phone number, and notes) of any existing customer record, including those linked to administrator accounts. Attackers can do this by submitting the booking form with a known customer's email address.

Exploitation requires the plugin to have guest bookings enabled, which triggers the vulnerable unauthenticated code path.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to unauthorized modification of customer data, including sensitive personally identifiable information. An attacker could alter details such as names, phone numbers, and notes associated with any customer, even those linked to administrator accounts.

Such unauthorized changes could result in data integrity issues, loss of trust, and potential misuse of customer information.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows unauthenticated attackers to modify personally identifiable information (PII) such as first name, last name, phone number, and notes of any existing customer record, including those linked to administrator accounts.

Such unauthorized modification of PII can lead to violations of data protection regulations like GDPR and HIPAA, which require strict controls over the confidentiality and integrity of personal data.

Because the plugin does not properly verify user authorization, it increases the risk of data breaches or unauthorized data manipulation, potentially resulting in non-compliance with these standards.

Useful 0 Not Useful 0