Sensitive Information Exposure in LatePoint Scheduling Plugin for WordPress

CVE-2026-111602

What is CVE-2026-111602?

The Appointment Booking Plugin – LatePoint for WordPress is susceptible to a vulnerability that allows unauthenticated attackers to access sensitive customer information. When configured with guest checkout mode, this vulnerability enables attackers to exploit the 'params (customer[uuid])' parameter through the steps__load_step AJAX endpoint. By enumerating uuid prefixes, attackers can extract details such as first name, last name, email address, phone number, and additional notes from the database of every customer record.

References