CVE-2026-94432: Appointment Booking Plugin <= 5.7.1 - Insecure Direct Object Reference to Unauthenticated Unauthorized Transaction Intent Creation/Modification and Invoice Enumeration via 'invoice_id' Parameter
The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 5.7.1 via the OsPaypalConnectController::createorderfortransaction() action registered as a public (unauthenticated) route through wpajaxnoprivlatepointroutecall. The handler loads an OsInvoiceModel by a sequential integer 'invoiceid' with no access-key/UUID or ownership check (the sibling Stripe and Razorpay handlers require a 128-bit access-key UUID via OsInvoicesHelper::getinvoicebykey), and then calls OsTransactionIntentHelper::createorupdatetransactionintent() which persists a transaction intent tied to the target invoice's customerid, orderid and chargeamount and regenerates its intentkey before the PayPal-configured guard is reached. This makes it possible for unauthenticated attackers to enumerate invoices belonging to arbitrary customers, create unauthorized transaction-intent rows linked to another customer's data, and overwrite the intentkey of any in-flight NEW-status transaction intent — invalidating the intentkey that legitimate Stripe/Razorpay flows are waiting on and breaking payment webhooks for those customers.
Affected Software
Event History
Frequently Asked Questions
Which installations are affected?
WordPress sites running the LatePoint Appointment Booking Plugin version 5.7.1 or earlier are affected. The vulnerable handler is exposed through the public, unauthenticated wp_ajax_nopriv_latepoint_route_call route.
What does an attacker need to exploit this issue?
No authentication or user interaction is required. An attacker needs to supply invoice_id values; invoice records are addressed by sequential integer IDs and the handler does not perform an ownership check or require an access-key UUID.
What can an attacker change or access?
An attacker can enumerate invoices for arbitrary customers and create transaction-intent records associated with another customer's customer ID, order ID, and charge amount. They can also overwrite the intent_key of an in-flight transaction intent in NEW status, disrupting legitimate Stripe or Razorpay payment flows.