ZeroDay Findings
Sign inSign up

Findings

CVE-2026-103366

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up…

Published Oct 14, 2026 · updated Oct 15, 2026

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 5.7.3 via the and parameters on the and public routes (reachable through wp_ajax_nopriv_latepoint_route_call). This is due to feeding raw request parameters into and , which call and load an arbitrary booking or cart row by primary key with no ownership check — the ownership guard the vendor added for the earlier disclosure lives only inside and does not cover the sibling routes or at all. This makes it possible for unauthenticated attackers to enumerate sequential booking / cart identifiers and read other customers' appointment details (service name, agent, date/time, duration, price breakdown, status) and other shoppers' pending checkout contents directly from the JSON responses.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 14, 2026 · NIST NVD

    Detected

    The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 5.7.3 via the and parameters on the and public routes (reachable through wp_ajax_nopriv_latepoint_route_call). This is due to feeding raw request parameters into and , which call and load an arbitrary booking or ca

  2. Oct 15, 2026 · NIST NVD

    Updated

    The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 5.7.3 via the and parameters on the and public routes (reachable through wp_ajax_nopriv_latepoint_route_call). This is due to feeding raw request parameters into and , which call and load an arbitrary booking or ca

Sources

  • CVE.orgVulnerability recordCVE-2026-103366

    Official CVE identifier

    cve.org
  • NIST NVDVulnerability recordCVE-2026-103366

    The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 5.7.3 via the and parameters on the `steps__reload_booking_form_summa

    nvd.nist.gov

References