CVE-2026-5234: LatePoint <= 5.3.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Financial Data Exposure via Sequential Invoice ID

The LatePoint plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.3.2. The vulnerability exists because the OsStripeConnectController::createpaymentintentfortransaction action is registered as a public action (no authentication required) and loads invoices by sequential integer invoiceid without any accesskey or ownership verification. This is in contrast to other invoice-related actions (viewbykey, paymentform, summarybeforepayment) in OsInvoicesController which properly require a cryptographic UUID accesskey. This makes it possible for unauthenticated attackers to enumerate valid invoice IDs via an error message oracle, create unauthorized transaction intent records in the database containing sensitive financial data (invoiceid, orderid, customerid, chargeamount), and on sites with Stripe Connect configured, the response also leaks Stripe paymentintentclientsecret tokens, transactionintentkey values, and payment amounts for any invoice.