CVE-2026-105197: LatePoint < 5.6.5 - Agent+ Arbitrary Order, Customer and Transaction Deletion via IDOR
The Appointment Booking Plugin WordPress plugin before 5.6.5 does not verify that a backend staff user is authorized to act on the specific record targeted for deletion, allowing an authenticated user with a record-scoped staff role to irreversibly delete any order, customer, or transaction on the site, including records belonging to other staff and outside their assigned scope.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated backend staff user with a record-scoped staff role can exploit it. The attacker must be able to access the relevant deletion functionality in the plugin backend.
What data can be affected?
An authorized staff user can delete orders, customers, and transactions outside their assigned scope, including records belonging to other staff. The deletions are described as irreversible.
Are all LatePoint versions affected?
The issue affects LatePoint versions before 5.6.5. Updating to version 5.6.5 or later addresses the affected version range described.
What can be done if an update cannot be applied immediately?
Restrict backend access to trusted staff users and review record-scoped staff roles, since those users can target records outside their assigned scope. Limit access to deletion functionality where possible.