CVE-2026-12657: LatePoint WordPress Plugin IDOR Vulnerability – Unauthorized Booking Bypass

Technical summary

CVE-2026-12657 is an Insecure Direct Object Reference (IDOR) vulnerability in the LatePoint plugin affecting all versions through 5.6.2. The flaw exists in two publicly accessible AJAX endpoints: 'steps__load_step' and 'steps__start'. Both endpoints accept user-controlled parameters ('service_id' and 'presets[selected_service]' respectively) without sufficient validation to ensure the requested service is actually accessible to the caller. An unauthenticated attacker can directly reference restricted service IDs in these parameters, bypass authorization checks, and create approved bookings against admin-only or agent-only services. This violates the principle of least privilege and allows capacity exhaustion of restricted appointment slots.

Business impact

Organizations using LatePoint for appointment scheduling face two primary business risks: operational disruption through unauthorized consumption of reserved appointment capacity (particularly for administrative or staff-only services), and potential service abuse where attackers fill restricted calendars with bogus bookings. If a business relies on reserved appointment slots for VIP clients, internal operations, or staff coordination, attackers can effectively deny availability. There is also a trust and compliance concern: if restricted services are meant for specific user tiers (e.g., premium subscribers or internal staff), the vulnerability undermines that segregation and could expose business logic flaws.

Affected systems

The LatePoint – Calendar Booking Plugin for Appointments and Events is affected in all versions up to and including 5.6.2. Any WordPress installation running this plugin version is vulnerable. The attack surface is high because the vulnerable AJAX endpoints are publicly accessible without authentication. No specific WordPress version dependencies are noted; vulnerability is tied to the plugin itself.

Exploitability

This vulnerability has a CVSS score of 5.3 (MEDIUM severity) with a network-based attack vector, low complexity, and no authentication requirement. Exploitation is straightforward: an attacker simply crafts an HTTP request to either the 'steps__load_step' or 'steps__start' AJAX endpoint, substituting a restricted service ID in the relevant parameter. No special user interaction, social engineering, or advanced techniques are required. The barrier to exploitation is very low—basic knowledge of HTTP requests and the plugin's parameter structure is sufficient. This combination of ease and lack of authentication requirement makes the vulnerability practically exploitable at scale.

Remediation

Organizations should update the LatePoint plugin to a patched version released after July 2, 2026 (verify against the vendor advisory for the specific version number). The patch will implement proper authorization checks on the 'service_id' and 'presets[selected_service]' parameters to ensure that only services accessible to the requesting user can be booked. Until a patch is available, consider temporarily disabling the plugin if appointment booking is not critical, or restricting access to the booking endpoints via web application firewall rules or IP whitelisting if the plugin is essential.

Patch guidance

Monitor the LatePoint plugin for an update addressing this IDOR vulnerability. When available, apply the patch immediately given the public nature of the vulnerability and the ease of exploitation. Before patching, test the update in a staging environment to ensure compatibility with your WordPress installation and any custom configurations. If you maintain a WordPress multisite or have multiple instances, prioritize patched deployments across all sites running LatePoint. Document the patch version in your change log for compliance and audit purposes.

Detection guidance

Monitor your WordPress access logs for unusual patterns in requests to the AJAX endpoints 'wp-admin/admin-ajax.php' with 'action=steps__load_step' or 'action=steps__start'. Look for repeated requests with varying 'service_id' or 'presets[selected_service]' values from the same IP or user agent, which may indicate reconnaissance or booking manipulation. If you have audit logging enabled on appointment data, review recent bookings against restricted services to see if approval status or creation patterns are anomalous. Additionally, correlate unexpected bookings with your web server logs to identify source IPs.

Why prioritize this

Although the CVSS score is MEDIUM (5.3), the practical risk is elevated: the vulnerability requires no authentication, has trivial exploitation complexity, and directly impacts service availability and business logic. Organizations relying on capacity-restricted or VIP-only appointment slots should prioritize this patch. The lack of a KEV notice does not diminish the risk—it reflects recency and limited observed exploitation rather than severity. Prioritize based on whether your business model depends on restricted appointment capacity or service segregation.

Risk score, explained

The CVSS 3.1 score of 5.3 reflects a network-accessible vulnerability with no authentication required (AV:N, PR:N), low complexity (AC:L), and no user interaction (UI:N). The impact is limited to integrity (I:L)—an attacker can create unauthorized bookings but cannot read sensitive data (C:N) or degrade system availability to all users (A:N). The score appropriately captures the ease of exploitation and direct business-logic impact, though it does not account for context-specific severity (e.g., if your business critically depends on appointment slot exclusivity, your internal risk may be higher).

Frequently asked questions