Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-103380— Appointment Booking Plugin <= 5.7.3 - Authenticated (Subscriber+) Sensitive Information Exposure in 'first_name' Parameter Template Re-expansion

Quick assessment

Affected
latepoint Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

WordPress 插件 Appointment Booking Plugin – LatePoint 此漏洞允许已认证且拥有订阅者（subscriber）或以上权限的攻击者，提取受保护的预订数据，包括仅管理员可访问的 字段、已分配代理的内部联系方式、交易令牌以及通过渲染通知邮件发送的支付请求链接。 攻击者可通过调用 接口，在其 字段中存储模板占位符（例如 ），随后触发密码重置邮件流程，从而在收到的通知邮件中获取该占位符被扩展后的实际值，实现敏感信息的窃取。

CVSS 4.3 · Medium EPSS 0.31% · P22

Affected Version Matrix 1

VendorProduct Version RangeStatus
latepoint Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress ≤ 5.7.3 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-103380

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Appointment Booking Plugin <= 5.7.3 - Authenticated (Subscriber+) Sensitive Information Exposure in 'first_name' Parameter Template Re-expansion
Source: CVE Program / CVE List V5
Vulnerability Description
The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.7.3 via the 'params[customer][first_name]' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract privileged booking data including the administrator-only admin_notes field, assigned agent internal contact details, transaction tokens, and payment request URLs delivered via rendered notification emails. A LatePoint customer can exploit this by storing a template placeholder such as {{customer_admin_notes}} in their own first_name field via the customer_cabinet__update route, then triggering the password-reset email flow to receive the expanded value in the resulting notification.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
信息暴露
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
latepoint Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress 0 ~ 5.7.3 -

II. Public POCs for CVE-2026-103380

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-103380

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-103380 (1)

Other References for CVE-2026-103380 (6)

Same Patch Batch · latepoint · 2026-10-14 · 3 CVEs total

CVE-2026-103366 7.5 HIGH Appointment Booking Plugin <= 5.7.3 - Insecure Direct Object Reference to Unauthenticated
CVE-2026-100163 7.4 HIGH Appointment Booking Plugin <= 5.7.2 - Unauthenticated Authentication Bypass to Customer Ac

IV. Related Vulnerabilities

Same product: Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress
Same vendor: latepoint
Same weakness: CWE-200

V. Comments for CVE-2026-103380

No comments yet

Leave a comment