CVE-2026-92966: Appointment Booking Plugin <= 5.7.0 - Unauthenticated Arbitrary Shortcode Execution via First/Last Name Field
The The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.7.0. This is due to the software allowing users to execute an action that does not properly validate a value before running doshortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. The payload is planted during the unauthenticated booking flow and triggered when the Customer Cabinet block rendered by rendercustomerdashboard() outputs the stored name into the content stream, where WordPress core's doshortcode filter at priority 11 re-parses and executes it.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to exploitation?
LatePoint installations running version 5.7.0 or earlier are affected where an unauthenticated user can use the booking flow and stored customer names are later rendered through the Customer Cabinet block.
What does an attacker need to do to trigger the issue?
The attacker does not need authentication. They can place a shortcode payload in the first or last name field during booking; it executes when render_customer_dashboard() outputs the stored name and WordPress re-parses the content through do_shortcode.
How can I determine whether my site is affected?
Check whether the installed LatePoint version is 5.7.0 or earlier. Also review customer first and last name values submitted through unauthenticated bookings, particularly for shortcode-like content that could be rendered in the Customer Cabinet dashboard.