CVE-2026-17538
Received Received - Intake

Authenticated IDOR in LatePoint WordPress Plugin Allows Customer Data Manipulation

Publication date: 2026-10-08

Last updated on: 2026-10-08

Assigner: Wordfence

Description
The LatePoint - Appointment Booking & Reservation plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 5.6.9. This is due to the process_step_customer() function using is_user_logged_in() as the sole gate before merging POSTed customer data into an existing LatePoint customer, without any ownership checks. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify the personal information (first name, last name, email, phone, notes) of arbitrary LatePoint customers, and, when the contact_merge setting is 'phone', to overwrite the victim's email address and take over the account via a password reset.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-08
Last Modified
2026-10-08
Generated
2026-10-08
AI Q&A
2026-10-08
EPSS Evaluated
N/A
NVD
CVE-2026-17538
EUVD
EUVD-2026-94652

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
latepoint Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The LatePoint WordPress plugin has an Insecure Direct Object Reference vulnerability in versions up to 5.6.9. The process_step_customer() function allows authenticated users with Subscriber access or higher to modify personal details of any LatePoint customer without proper ownership verification. Attackers can change names, emails, phone numbers, and notes, and if the contact_merge setting is set to phone, they can overwrite the victim's email and take over the account via password reset.

Detection Guidance

To detect this vulnerability, check if the LatePoint plugin version is 5.6.9 or lower. Inspect WordPress user roles with Subscriber access or higher for unusual activity like modified customer data. Review server logs for POST requests targeting the process_step_customer() function.

Impact Analysis

If you use the LatePoint plugin, attackers could modify your personal information, steal your account by changing your email, or disrupt your bookings. Even with minimal access, they can alter customer data, leading to account takeovers or misinformation in your scheduling system.

Compliance Impact

This vulnerability could lead to violations of GDPR or HIPAA by allowing unauthorized modification of personal data. GDPR requires protecting personal data integrity, while HIPAA mandates safeguarding patient information. Unauthorized changes could result in data breaches or non-compliance penalties.

Mitigation Strategies

Update the LatePoint plugin to the latest version immediately to patch the insecure direct object reference vulnerability. If an update is not available, consider disabling the plugin temporarily until a fix is released.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-17538. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart