Sensitive Information Exposure in Appointment Booking Plugin for WordPress

CVE-2026-103380

What is CVE-2026-103380?

The Appointment Booking Plugin – LatePoint for WordPress has a vulnerability that allows authenticated users with subscriber-level access and above to access sensitive booking data. The vulnerability arises from the 'params[customer][first_name]' parameter, which can be exploited by inserting template placeholders. By doing so, attackers may receive privileged information such as admin notes, internal agent contact details, transaction tokens, and URLs for payment requests through notification emails. This exposure raises significant concerns over user data protection and privacy.

References