CVE-2026-11398: LatePoint WordPress Plugin Authorization Bypass – Guest Booking Vulnerability

Technical summary

CVE-2026-11398 is an authorization bypass vulnerability in the LatePoint plugin (versions up to 5.6.1) stemming from insufficient authorization verification in the process_step_customer() function. When is_customer_auth_disabled() returns true (guest bookings enabled), the unauthenticated code path fails to validate that a requester has permission to modify customer records. An attacker can submit a booking form containing a known customer's email address along with modified PII fields (first_name, last_name, phone, notes) to update arbitrary customer records in the database. The vulnerability has a CVSS 3.1 score of 5.3 (integrity impact, no authentication required) and maps to CWE-862 (Missing Authorization).

Business impact

This vulnerability directly compromises customer data integrity. Organizations using LatePoint with guest bookings enabled are exposed to unauthorized modification of customer records, including those associated with administrator accounts. The risk extends beyond simple defacement: attackers can corrupt phone numbers, alter booking notes, or inject malicious content into customer profiles. For appointment-driven businesses (medical practices, salons, consulting firms), corrupted customer data can disrupt operations, erode customer trust, and create compliance exposure under GDPR, CCPA, and similar regulations if customer PII is modified without consent.

Affected systems

All versions of the LatePoint – Calendar Booking Plugin for Appointments and Events up to and including version 5.6.1 are affected. The vulnerability requires the plugin to be installed and active on a WordPress site with guest bookings enabled (the default or common configuration for public appointment booking). Sites with guest bookings disabled are not susceptible to the unauthenticated attack vector described in this CVE.

Exploitability

Exploitability is straightforward. An attacker needs only a web browser and knowledge of a valid customer email address (often discoverable through public-facing booking pages, confirmation emails, or social engineering). The attack requires no authentication, no user interaction by the victim, and no special network positioning—it can be executed remotely over HTTP(S). However, the attacker must have guest bookings enabled on the target site, which limits scope but is a standard configuration for public appointment systems. No exploit code or proof-of-concept is required; a simple HTTP POST with modified form parameters is sufficient.

Remediation

Immediately update the LatePoint plugin to a patched version released after 5.6.1 (verify against the vendor advisory for the specific patch version). If an update is not immediately available, disable guest bookings in plugin settings as a temporary mitigation, though this may impact customer experience. Review customer records for any unauthorized modifications and consider notifying affected users if data corruption is detected. After patching, re-enable guest bookings if operationally necessary and verify the plugin enforces proper authorization checks on customer update operations.

Patch guidance

Check the LatePoint plugin repository and vendor advisory for a security patch released after version 5.6.1. Patches for this class of vulnerability typically add proper authorization verification (e.g., checking user capability or session ownership) before allowing customer record modifications. Deploy the patched version to your WordPress environment and test the booking flow in both authenticated and unauthenticated contexts to confirm guest submissions no longer modify unintended records. Consider automated patching or update monitoring to catch security releases promptly.

Detection guidance

Monitor WordPress audit logs and database activity logs for unexpected modifications to customer records, particularly changes to phone numbers, names, or notes fields in the LatePoint customer table. Look for POST requests to the booking form submission endpoint (typically wp-admin/admin-ajax.php with latepoint actions) originating from unauthenticated sessions. Correlate timestamps of suspicious modifications with access logs to identify patterns. Implement integrity monitoring on the customer table to flag bulk or sequential updates to multiple records. If available, enable WordPress security plugins that log unauthenticated form submissions or database changes.

Why prioritize this

This vulnerability warrants prompt but not emergency patching. The CVSS 5.3 score reflects medium severity—no confidentiality impact and no authentication bypass to privileged functions, but direct integrity risk. However, the low barrier to exploitation (unauthenticated, no user interaction required) and the high business impact of corrupted customer PII (especially for regulated industries) make it a priority for sites with guest bookings enabled. Organizations running appointment booking services should patch within 1–2 weeks; others with the plugin but guest bookings disabled can prioritize lower.

Risk score, explained

The CVSS 3.1 score of 5.3 reflects: Attack Vector Network (unauthenticated remote access), Attack Complexity Low (no special conditions beyond guest bookings being enabled), Privileges Required None, User Interaction None (direct server-side impact), Scope Unchanged, Confidentiality None (no data exposure), Integrity Low (customer record modification), Availability None. The score is not elevated to High because the vulnerability does not expose sensitive information, does not grant administrative access, and requires a common-but-not-universal configuration. The practical business risk may feel higher due to data integrity and regulatory implications, but the CVSS score appropriately reflects the technical attack surface.

Frequently asked questions