LatePoint guest checkout exposes other customers' personal information
LatePoint through 5.6.9 is affected by an insecure direct object reference in set_customer_object. When customer authentication is disabled and guest checkout is enabled, an unauthenticated attacker can vary the customer[id] parameter and retrieve other customers' first names, last names, email addresses and phone numbers because the selected customer is not properly authorized. This is a customer-data disclosure, not an established account-takeover or modification path. The export does not identify a complete request route. Its description explicitly allows unauthenticated access under the guest-checkout condition, despite the CNA CVSS vector recording PR:L; the configuration-dependent description is retained here.
- Component
- Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress
- Plugin slug
latepoint- Affected
- <= 5.6.9
- Safe version
- See mitigation notes
- Published
- Sep 18, 2026
This CVE was published Sep 18, 2026 and is one of 32 known issues for this plugin.
Update, patch or deactivate.
Enable customer authentication and disable guest checkout to remove the prerequisite described by the export. Update to the latest supported LatePoint release, but version 5.7.0 is not a confirmed fix for this CVE: the 5.6.10 changelog mentions security bugs without identifying this customer-object issue, and later entries do not clearly match it. A newer release may resolve it; obtain explicit vendor confirmation. The application-level repair must bind the selected customer to the authenticated user or a server-validated guest context and reject unauthorized customer identifiers before loading or returning personal information.
No confirmed safe version is listed. Consider a vendor-supported patch or temporarily restricting the affected functionality while you assess the risk.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.6.9 via the set_customer_object due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to enumerate arbitrary customer records and disclose personally identifiable information - including first name, last name, email address, and phone number - by iterating the customer[id] parameter. This issue is exploitable only when the site is configured with customer authentication disabled (guest checkout enabled).
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N