Insecure Direct Object Reference in LatePoint Plugin for WordPress
CVE-2026-5234
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 17 April 2026
What is CVE-2026-5234?
The LatePoint plugin for WordPress is susceptible to an Insecure Direct Object Reference due to the public registration of the OsStripeConnectController::create_payment_intent_for_transaction action. This vulnerability allows unauthenticated attackers to exploit sequential integer invoice IDs without requiring access verification. By doing so, they can create unauthorized transaction records in the database, which may expose sensitive financial information such as invoice IDs, order IDs, customer IDs, and charge amounts. Additionally, in setups utilizing Stripe Connect, the attackers may gain access to sensitive payment details, including payment_intent_client_secret tokens and transaction amounts.
Affected Version(s)
LatePoint – Calendar Booking Plugin for Appointments and Events 0 <= 5.3.2