CVE-2026-103366: Appointment Booking Plugin <= 5.7.3 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'booking[id]' and 'cart[id]' Parameters
The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 5.7.3 via the booking[id] and cart[id] parameters on the stepsreloadbookingformsummarypanel and stepsstart public routes (reachable through wpajaxnoprivlatepointroutecall). This is due to OsStepsHelper::setrequiredobjects() feeding raw request parameters into setbookingobject() and setcartobject(), which call OsModel::setdata() and load an arbitrary booking or cart row by primary key with no ownership check — the ownership guard the vendor added for the earlier disclosure lives only inside OsStepsHelper::loadstep() and does not cover the sibling routes or cart[id] at all. This makes it possible for unauthenticated attackers to enumerate sequential booking / cart identifiers and read other customers' appointment details (service name, agent, date/time, duration, price breakdown, status) and other shoppers' pending checkout contents directly from the JSON responses.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated remote attacker can exploit it. No WordPress account, customer session, or user interaction is required.
What information could be exposed?
Attackers can retrieve other customers' appointment details, including service name, assigned agent, date and time, duration, price breakdown, and status. They can also access other shoppers' pending checkout cart contents.
What does an attacker need to do to access another record?
The attacker supplies booking[id] or cart[id] values to the affected public routes and can enumerate sequential identifiers. The affected object-loading logic accepts the requested primary key without verifying ownership.
Are public or default-facing booking workflows affected?
Yes. The affected routes are public and reachable through wp_ajax_nopriv_latepoint_route_call, which is intended to handle requests from unauthenticated visitors.
Which versions are affected?
Versions up to and including 5.7.3 are affected. The provided information does not identify a fixed version.