CVE-2026-13471: LatePoint <= 5.6.3 - Authenticated (Custom+) Insecure Direct Object Reference to Arbitrary Booking Deletion and Customer/Booking Data Disclosure via Abilities REST API (list-bookings, list-customers, delete-booking)
The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.6.3 via the LatePointAbilityDeleteBooking::execute due to missing validation on a user controlled key. This makes it possible for attackers, with LatePoint Agent-level access and above, to read bookings and customer PII (full name, email, phone, and notes) assigned to other LatePoint agents, and delete arbitrary bookings by supplying any booking ID. This vulnerability is only exploitable when an administrator has enabled the Abilities API toggles (latepointabilitiesapi, latepointabilitiesapidelete, and/or latepointabilitiesapiedit) in the plugin settings.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
If not required, disable the Abilities API toggle in LatePoint plugin settings: set latepoint_abilities_api to off.
LatePoint – Calendar Booking Plugin for WordPress latepoint_abilities_api = disable (turn off) - Configuration
If not required, disable booking deletion via the Abilities API: set latepoint_abilities_api_delete to off.
LatePoint – Calendar Booking Plugin for WordPress latepoint_abilities_api_delete = disable (turn off) - Configuration
If not required, disable editing via the Abilities API: set latepoint_abilities_api_edit to off.
LatePoint – Calendar Booking Plugin for WordPress latepoint_abilities_api_edit = disable (turn off)
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs LatePoint Agent-level access or higher. They can access bookings and customer information assigned to other LatePoint agents and delete bookings by supplying booking IDs.
Are default LatePoint installations affected?
Exploitation requires an administrator to have enabled the Abilities API settings: latepoint_abilities_api, latepoint_abilities_api_delete, and/or latepoint_abilities_api_edit. The issue is not exploitable unless the relevant Abilities API toggles are enabled.
What information and actions are exposed?
An affected attacker can disclose customer full names, email addresses, phone numbers, and notes, along with booking data. They can also delete arbitrary bookings.
How can I determine whether my site is exposed?
Check whether LatePoint is version 5.6.3 or earlier, whether users have Agent-level or higher access, and whether the Abilities API toggles are enabled in the plugin settings.
What can be done if updating is not immediately possible?
Disable the enabled Abilities API toggles, particularly the API, delete, and edit options, until an update can be applied. Restrict Agent-level access to only trusted users.