Unauthorized Record Deletion in Appointment Booking Plugin

Executive Summary

This vulnerability is an Insecure Direct Object Reference (IDOR) flaw in the WordPress plugin LatePoint before version 5.6.5. It allows authenticated users with a record-scoped staff role to delete any order, customer, or transaction on the site without proper authorization checks. This includes records belonging to other staff or outside their assigned scope, leading to irreversible data loss.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your WordPress site uses the Appointment Booking Plugin (or LatePoint) versions prior to 5.6.5. Log in as a staff user with record-scoped permissions and attempt to delete records outside your assigned scope. If deletion succeeds without proper authorization, the vulnerability exists.

Useful 0 Not Useful 0

Impact Analysis

If exploited, this vulnerability could allow unauthorized users to delete critical data such as orders, customer records, or transactions. This could disrupt business operations, cause data loss, and potentially affect customer trust and financial records.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to non-compliance with GDPR or HIPAA by allowing unauthorized deletion of personal or sensitive data. GDPR requires protection of personal data, and HIPAA mandates safeguarding protected health information. Unauthorized deletions may violate these regulations, resulting in legal penalties or fines.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update the Appointment Booking Plugin (or LatePoint) to version 5.6.5 or later. If updating is not possible, disable the plugin temporarily until the update is applied. Review all staff user permissions to ensure proper access controls are in place.

Useful 0 Not Useful 0