CVE-2026-105256: LatePoint < 5.7.5 - Unauthenticated Payment Bypass via 'payment_portion' Parameter
The LatePoint WordPress plugin before 5.7.5 does not validate the client-supplied value that determines how much is charged for a booking against the amounts the service and site actually allow, allowing an unauthenticated visitor to make the amount due resolve to zero and obtain a confirmed appointment and a recorded order without completing any payment.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
LatePoint WordPress pluginto a version that resolves this vulnerability.Fixed in 5.7.5
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated visitor who can submit a booking request to an affected LatePoint installation can exploit it. No account, privileges, or user interaction are required.
What is the practical impact of exploitation?
An attacker can cause the amount due for a booking to resolve to zero, then obtain a confirmed appointment and a recorded order without completing payment. The reported impact is integrity-related rather than disclosure or service disruption.
Which installations are affected?
LatePoint versions earlier than 5.7.5 are affected. The issue concerns booking flows that accept the client-supplied payment_portion parameter.
How can I determine whether an appointment may have been created through this issue?
Review recorded orders and confirmed appointments for bookings with a zero amount due where payment was not completed. The vulnerability specifically results in confirmed appointments and recorded orders without payment.