CVE-2026-103380: Appointment Booking Plugin <= 5.7.3 - Authenticated (Subscriber+) Sensitive Information Exposure in 'first_name' Parameter Template Re-expansion
The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.7.3 via the 'params[customer][firstname]' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract privileged booking data including the administrator-only adminnotes field, assigned agent internal contact details, transaction tokens, and payment request URLs delivered via rendered notification emails. A LatePoint customer can exploit this by storing a template placeholder such as {{customeradminnotes}} in their own firstname field via the customercabinetupdate route, then triggering the password-reset email flow to receive the expanded value in the resulting notification.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs an authenticated LatePoint customer account with at least subscriber-level access. They must be able to update their customer profile through the customer_cabinet__update route and trigger the password-reset email flow.
What information could be exposed?
The issue can expose privileged booking data through rendered notification emails, including administrator-only admin_notes, assigned agent internal contact details, transaction tokens, and payment request URLs.
Which versions are affected?
All LatePoint versions up to and including 5.7.3 are affected.
How does exploitation work in practice?
The attacker stores a template placeholder, such as {{customer_admin_notes}}, in the params[customer][first_name] value. When the password-reset notification is generated, the placeholder is re-expanded and its value is delivered in the resulting email.