Insecure Direct Object Reference in LatePoint Appointment Booking Plugin for WordPress

CVE-2026-17538

What is CVE-2026-17538?

The LatePoint - Appointment Booking & Reservation plugin for WordPress suffers from an Insecure Direct Object Reference vulnerability due to inadequate ownership checks in the process_step_customer() function. This flaw allows authenticated attackers with Subscriber-level access or higher to modify the personal information of any LatePoint customer without appropriate authorization. Specifically, attackers can alter details such as first name, last name, email, phone number, and notes. If the contact_merge setting is configured to use a phone number, the attacker can even overwrite a victim’s email address, potentially leading to account takeovers via password reset functionalities.

References