CVE-2026-9719: LatePoint <= 5.6.0 - Cross-Site Request Forgery via invoices__change_status Action
The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.6.0. This is due to missing or incorrect nonce validation on the changestatus function. This makes it possible for unauthenticated attackers to change the status of arbitrary invoices — including marking unpaid invoices as paid — without administrator consent via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
LatePoint – Calendar Booking Plugin for Appointments and Events (WordPress)to a version that resolves this vulnerability.Fixed in 5.6.0 - Compensating control
Ensure that forged requests cannot be used to change invoice status by requiring administrator confirmation for status-changing actions (e.g., do not allow state-changing actions via clickable links that can be triggered by CSRF).
Event History
Frequently Asked Questions
What is the risk associated with CVE-2026-9719?
CVE-2026-9719 has a medium severity risk rating of 4.3.
What kind of vulnerability is CVE-2026-9719?
CVE-2026-9719 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the LatePoint plugin for WordPress.
How can I mitigate CVE-2026-9719?
To mitigate CVE-2026-9719, ensure proper nonce validation is implemented for the change_status action in the LatePoint plugin.
Which versions of LatePoint are affected by CVE-2026-9719?
CVE-2026-9719 affects all versions of LatePoint up to and including 5.6.0.
What does the missing nonce validation in CVE-2026-9719 allow?
The lack of proper nonce validation in CVE-2026-9719 allows unauthenticated users to perform certain actions, compromising the integrity of the application.