CVE-2026-5356: LatePoint WordPress Plugin Payment Fraud Vulnerability (CVSS 7.5)

Technical summary

CVE-2026-5356 is an improper input validation vulnerability (CWE-862) in LatePoint versions up to 5.4.0. The Stripe Connect integration fails to validate that a submitted PaymentIntent ID actually belongs to the current transaction context. An attacker can supply a valid PaymentIntent token from any prior successful payment—their own or intercepted from elsewhere—and the plugin will accept it as proof of payment without re-authenticating or re-authorizing the charge with Stripe's API. The vulnerability requires no authentication and no user interaction, making it network-accessible and trivial to exploit at scale.

Business impact

Financially, organizations running affected LatePoint installations face direct revenue loss through payment fraud. Attackers can book appointments or purchase services while paying arbitrary amounts (potentially zero) by replaying legitimate payment tokens. Beyond direct theft, this creates operational chaos: customers may dispute charges, refund requests multiply, and reconciliation between actual payments received and booked services becomes unreliable. Reputational damage follows when customers discover their booking confirmations were fraudulently processed. For service providers relying on the plugin for scheduling and billing, this vulnerability essentially breaks payment integrity.

Affected systems

The vulnerability affects all versions of the LatePoint – Calendar Booking Plugin for Appointments and Events up to and including version 5.4.0. Any WordPress installation with this plugin active and Stripe Connect configured for payments is exposed. The vulnerability does not require the attacker to have WordPress user privileges or site access; it is exploitable purely through the booking interface. Multisite WordPress installations are equally vulnerable if LatePoint is activated.

Exploitability

This vulnerability scores high on exploitability: it requires no authentication (PR:N), no special interaction (UI:N), and is network-accessible (AV:N) with low complexity (AC:L). An attacker needs only to identify a WordPress site running LatePoint, observe or obtain a valid Stripe PaymentIntent ID from a legitimate transaction (via public booking pages, email confirmations, or intercepted requests), and replay it when making their own booking. Automated attacks are straightforward, and no special tooling beyond HTTP requests is necessary. The attack surface is as wide as public booking pages using the plugin.

Remediation

Organizations must immediately update LatePoint to a patched version beyond 5.4.0 when available from the vendor. The patch should enforce server-side validation of PaymentIntent IDs, ensuring each token is tied to a specific booking transaction and cannot be reused. Until patching is possible, temporarily disable Stripe Connect in LatePoint or take the booking form offline and process payments through an alternative, validated payment gateway outside the plugin. Audit recent payment records for suspicious reuse patterns or mismatched payment amounts.

Patch guidance

Monitor the LatePoint plugin repository and the vendor's security advisories for a version release that addresses input validation of Stripe PaymentIntent tokens. Verify against the official plugin changelog or vendor security notice that the patch includes server-side validation of payment tokens before marking a booking as paid. After applying any update, test a booking transaction end-to-end to confirm payment processing still functions and does not accept replayed or out-of-context tokens.

Detection guidance

Examine Stripe payment logs for PaymentIntent IDs that are reused across multiple bookings or customers, or for PaymentIntent confirmations that do not correspond to a recorded charge in Stripe's dashboard. Review WordPress booking records (if LatePoint stores them) for entries marked as paid with inconsistent payment amounts or timestamps. Monitor web server logs for repeated POST requests to LatePoint's payment processing endpoints from different IP ranges using identical PaymentIntent parameters. Alert on bookings completed with zero or suspiciously low payment amounts.

Why prioritize this

This vulnerability merits immediate patching priority due to its high CVSS score (7.5), unauthenticated exploitability, and direct financial impact. The attack is trivial to execute at scale and requires minimal resources. Any organization accepting payments through LatePoint has both a security and compliance obligation (PCI-DSS, state payment laws) to remediate payment processing flaws urgently. The lack of KEV status does not reduce urgency—this is a straightforward, high-impact vulnerability that defenders must assume is known and being exploited.

Risk score, explained

The CVSS 3.1 score of 7.5 (HIGH) reflects a network-accessible, unauthenticated attack with no user interaction required (AV:N/PR:N/UI:N), low attack complexity, and high integrity impact (I:H) through payment fraud. Confidentiality and availability are not directly compromised, but the integrity of billing and payment records is destroyed. The score appropriately conveys that this is a severe financial security flaw affecting any site using LatePoint with Stripe, though it stops short of critical because exploitation does not lead to remote code execution or system compromise.

Frequently asked questions