CVE-2026-111602: Appointment Booking Plugin <= 5.7.4 - Unauthenticated Sensitive Information Disclosure via ORM Operator Injection in 'customer[uuid]' Parameter
The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.7.4 via the 'params (customer[uuid])' parameter. This makes it possible for unauthenticated attackers to extract the first name, last name, email address, phone number, and notes of every customer record in the database by enumerating uuid prefixes via the unauthenticated stepsloadstep AJAX endpoint. This vulnerability is only exploitable when the LatePoint plugin is configured with the 'Field used for authentication' setting set to 'Disable ability to login' (guest checkout mode).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Change the 'Field used for authentication' setting from 'Disable ability to login' (guest checkout mode) to another authentication option.
LatePoint Appointment Booking Plugin Field used for authentication = not "Disable ability to login"
Event History
Frequently Asked Questions
Which deployments are affected by this issue?
LatePoint installations running version 5.7.4 or earlier are affected only when the "Field used for authentication" setting is configured as "Disable ability to login," which enables guest checkout mode.
Does exploitation require an account or user interaction?
No. An unauthenticated attacker can target the unauthenticated steps__load_step AJAX endpoint; however, exploitation has high attack complexity because it relies on enumerating customer UUID prefixes.
What information could be exposed?
An attacker may extract customer first names, last names, email addresses, phone numbers, and notes for every customer record in the database.
What can be done if updating is not immediately possible?
Disable guest checkout mode by changing the "Field used for authentication" setting from "Disable ability to login." The issue is only exploitable with that setting enabled.