CVE-2026-111602
Received Received - Intake

Sensitive Information Exposure in Appointment Booking Plugin – LatePoint

Publication date: 2026-10-17

Last updated on: 2026-10-17

Assigner: Wordfence

Description
The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.7.4 via the 'params (customer[uuid])' parameter. This makes it possible for unauthenticated attackers to extract the first name, last name, email address, phone number, and notes of every customer record in the database by enumerating uuid prefixes via the unauthenticated steps__load_step AJAX endpoint. This vulnerability is only exploitable when the LatePoint plugin is configured with the 'Field used for authentication' setting set to 'Disable ability to login' (guest checkout mode).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-17
Last Modified
2026-10-17
Generated
2026-10-17
AI Q&A
2026-10-17
EPSS Evaluated
N/A
NVD
CVE-2026-111602
EUVD
EUVD-2026-103218

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
latepoint Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Appointment Booking Plugin – LatePoint for WordPress has a vulnerability that allows unauthenticated attackers to access sensitive customer data. By exploiting the 'params (customer[uuid])' parameter and using the unauthenticated steps__load_step AJAX endpoint, attackers can enumerate UUID prefixes to extract first names, last names, email addresses, phone numbers, and notes from every customer record in the database. This only works if the plugin is configured with 'Disable ability to login' (guest checkout mode).

Detection Guidance

To detect this vulnerability, check if the LatePoint plugin is installed and active on your WordPress site. Inspect network traffic for unauthenticated requests to the steps__load_step AJAX endpoint containing the 'customer[uuid]' parameter. Look for exposed customer data in responses.

Impact Analysis

If you use the LatePoint plugin in guest checkout mode, attackers could steal customer data including names, emails, phone numbers, and notes. This could lead to privacy breaches, identity theft, or phishing attacks targeting your customers. The impact is limited to data exposure as no code execution or system compromise is involved.

Compliance Impact

This vulnerability likely violates GDPR due to unauthorized access to personal data. It may also breach HIPAA if customer data includes protected health information. Organizations using this plugin in guest mode could face fines, legal action, and reputational damage for failing to protect sensitive customer data.

Mitigation Strategies

Immediately update the LatePoint plugin to the latest version if available. If using guest checkout mode, disable it by changing the 'Field used for authentication' setting to a valid login method. Monitor for unauthorized data access and consider temporarily disabling the plugin until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-111602. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart