WordPress security changelog
MEDIUM CVE-2026-13471 Deferred

Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress: LatePoint agents can access and delete other agents' bookings

The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.6.3 via the LatePointAbilityDeleteBooking::execute due to missing validation on a user controlled key. This makes it possible for attackers, with LatePoint Agent-level access and above, to read bookings and customer PII (full name, email, phone, and notes) assigned to other LatePoint agents, and delete arbitrary bookings by supplying any booking ID. This vulnerability is only exploitable when an administrator has enabled the Abilities API toggles (latepoint_abilities_api, latepoint_abilities_api_delete, and/or latepoint_abilities_api_edit) in the plugin settings. The Abilities API settings are required; the export does not give the full REST route. Its described deletion impact goes beyond a read-only interpretation of the score. Affected versions reported by the CNA: <= 5.6.3. No fixed release is confirmed for this CVE in this review.

CVE / CNA score 4.3 CVSS 3.1 · security@wordfence.com
NVD score Pending NVD has not published its own CVSS assessment.
Component
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress
Plugin slug
latepoint
Affected
<= 5.6.3
Safe version
See mitigation notes
Published
Sep 18, 2026
Weakness
CWE-639 — Authorization Bypass Through User-Controlled Key

This CVE was published Sep 18, 2026 and is one of 32 known issues for this plugin.

What to do

Update, patch or deactivate.

The official changelog was checked against the currently listed 5.7.0 release, but no clear fix for this specific issue was confirmed. A newer release may resolve it; do not treat the version number or a generic security entry as proof. Official changelog: https://wordpress.org/plugins/latepoint/#developers Disable the affected Abilities API toggles until fixed. Require action-specific capability and booking ownership checks before reading, editing or deleting an appointment.

No confirmed safe version is listed. Consider a vendor-supported patch or temporarily restricting the affected functionality while you assess the risk.

Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.

Source record

Technical description

The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.6.3 via the LatePointAbilityDeleteBooking::execute due to missing validation on a user controlled key. This makes it possible for attackers, with LatePoint Agent-level access and above, to read bookings and customer PII (full name, email, phone, and notes) assigned to other LatePoint agents, and delete arbitrary bookings by supplying any booking ID. This vulnerability is only exploitable when an administrator has enabled the Abilities API toggles (latepoint_abilities_api, latepoint_abilities_api_delete, and/or latepoint_abilities_api_edit) in the plugin settings.

CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

References

Primary and upstream sources