CVE-2026-17538: Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress <= 5.6.9 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Customer PII Modification
The LatePoint - Appointment Booking & Reservation plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 5.6.9. This is due to the processstepcustomer() function using isuserloggedin() as the sole gate before merging POSTed customer data into an existing LatePoint customer, without any ownership checks. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify the personal information (first name, last name, email, phone, notes) of arbitrary LatePoint customers, and, when the contactmerge setting is 'phone', to overwrite the victim's email address and take over the account via a password reset.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated WordPress user with Subscriber-level access or higher can exploit it. The attacker does not need elevated WordPress administrative privileges.
What customer data can be changed?
An attacker can modify arbitrary LatePoint customers' first names, last names, email addresses, phone numbers, and notes.
Under what condition can this lead to customer account takeover?
Account takeover is possible when the LatePoint contact_merge setting is set to 'phone'. In that configuration, an attacker can overwrite a victim's email address and use a password reset to take over the account.