Insecure Direct Object Reference in LatePoint Scheduling Plugin for WordPress

CVE-2026-94432

What is CVE-2026-94432?

The Appointment Booking Plugin – LatePoint for WordPress has a significant security vulnerability that enables unauthenticated attackers to exploit the OsPaypalConnectController::create_order_for_transaction() action. This action is accessible without authentication and can be misused to load an OsInvoiceModel using a sequential invoice_id, without any verification for ownership or access keys. Consequently, attackers can potentially enumerate invoices pertaining to arbitrary customers, create unauthorized transaction-intents, and disrupt payment processes by overwriting critical transaction-related data. This vulnerability severely compromises payment integrity and customer security, particularly for transactions being processed via PayPal, given the dependency on the intent_key.

References