CVE-2026-12657: LatePoint <= 5.6.2 Unauthenticated IDOR Arbitrary Booking Creation via service_id

Vulnerability Overview Vulnerability Name: LatePoint <= 5.6.2 - Unauthenticated Insecure Direct Object Reference Leading to Arbitrary Creation via 'service_id' Parameter CVE ID: CVE-2026-12657 CVSS Score: 5.3 (Medium) Publication Date: July 1, 2026 Last Updated: July 2, 2026 Researcher: gidget smith Affected Versions Software Type: Plugin Software Name: LatePoint – Calendar Booking Plugin for Appointments and Events Affected Versions: <= 5.6.2 Fixed Version: 5.6.3 Remediation Recommendation: Upgrade to version 5.6.3 or later patched versions Vulnerability Description LatePoint is a calendar booking plugin for WordPress that allows users to schedule appointments and events. Versions 5.6.2 and earlier contain an Insecure Direct Object Reference (IDOR) vulnerability. Attackers can create unauthorized bookings via the 'service_id' parameter, thereby consuming admin/agent booking capacity and triggering unauthorized reservations. References plugins.trac.wordpress.org Additional Information Authorization Bypass via User-Controlled Key: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Recent Vulnerabilities LatePoint <= 5.6.1: Missing authorization leading to unauthenticated arbitrary customer data modification LatePoint <= 5.6.3: Authenticated (Customer+) privilege escalation to administrator LatePoint <= 5.5.1: Authenticated (Agent) privilege escalation to administrator LatePoint <= 5.6.0: Cross-Site Request Forgery via action LatePoint <= 5.5.1: Unauthenticated (Contributor+) privilege escalation LatePoint <= 5.3.2: Cross-Site Request Forgery via AJAX route LatePoint <= 5.5.0: Unauthenticated account takeover via weak password recovery mechanism LatePoint <= 5.5.0: Unauthenticated Stored Cross-Site Scripting via parameter LatePoint <= 5.5.0: Authenticated (Subscriber+) Stored Cross-Site Scripting via customer profile update Summary The LatePoint plugin, in versions 5.6.2 and earlier, contains an unauthenticated Insecure Direct Object Reference (IDOR) vulnerability. Attackers can create unauthorized bookings via the 'service_id' parameter. It is recommended to upgrade to version 5.6.3 or later patched versions to remediate this issue.

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-12657: LatePoint <= 5.6.2 Unauthenticated IDOR Arbitrary Booking Creation via service_id

More from this source