CVE-2026-105257: LatePoint < 5.7.5 - Agent+ Customer PII Disclosure via IDOR

Q: Which users can exploit this issue?

An authenticated user with an agent-level account can exploit it. The issue allows an agent to access customer records managed by other agents.

Q: What information could be exposed?

An affected agent can read and enumerate the personal information of every customer on the site through customer record retrieval or search functionality.

Q: Which versions are affected?

LatePoint versions before 5.7.5 are affected. Upgrading to 5.7.5 or later addresses the affected version range described.

Published Oct 21, 2026

Updated

The Appointment Booking Plugin WordPress plugin before 5.7.5 does not verify that an authenticated agent-level user is assigned to a customer before returning or searching that customer's record, allowing any agent to read and enumerate the personal information of every customer on the site, including those managed by other agents.

Affected Software

1 affected component

Latepoint LatePoint<5.7.5

Event History

Oct 21, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Which users can exploit this issue?

An authenticated user with an agent-level account can exploit it. The issue allows an agent to access customer records managed by other agents.

What information could be exposed?

An affected agent can read and enumerate the personal information of every customer on the site through customer record retrieval or search functionality.

Which versions are affected?

LatePoint versions before 5.7.5 are affected. Upgrading to 5.7.5 or later addresses the affected version range described.