CVE-2026-18441: LatePoint - Appointment Booking & Scheduling <= 5.6.9 - Unauthenticated Insecure Direct Object Reference to Sensitive Information Disclosure via 'customer[id]' Parameter
The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.6.9 via the setcustomerobject due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to enumerate arbitrary customer records and disclose personally identifiable information - including first name, last name, email address, and phone number - by iterating the customer[id] parameter. This issue is exploitable only when the site is configured with customer authentication disabled (guest checkout enabled).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
LatePoint - Appointment Booking & Scheduling (Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress)to a version that resolves this vulnerability.Fixed in 5.6.9
Event History
Frequently Asked Questions
Which deployments are exposed?
Exposure is limited to sites running LatePoint versions through 5.6.9 where customer authentication is disabled, meaning guest checkout is enabled. Sites that require customer authentication are not described as exploitable under this condition.
What does an attacker need to exploit this issue?
An attacker can exploit it remotely without authentication or user interaction when guest checkout is enabled. They would iterate values supplied through the customer[id] parameter to enumerate customer records.
What information could be disclosed?
The issue can disclose customer personally identifiable information, including first name, last name, email address, and phone number. The available data describes disclosure only; it does not describe modification or deletion of records.
What can be done if updating is not immediately possible?
Disable guest checkout and require customer authentication. This removes the configuration condition identified as necessary for exploitation.
How can I determine whether my site is affected?
Check whether the LatePoint plugin version is 5.6.9 or earlier and whether customer authentication is disabled or guest checkout is enabled. Both conditions are required for the described exploitation path.