Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
4.3

LatePoint plugin lets subscriber see admin notes and payment data

CVE-2026-103380 · published 21 days ago
Summary

The LatePoint appointment‑booking plugin for WordPress lets anyone with a basic subscriber account read information they should not see, such as internal notes, agent contacts, and payment details. This happens because the plugin mishandles data entered in a customer's first name field, exposing hidden information in email notifications. Update the plugin to the latest version or apply the vendor's patch to stop this data leak.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
latepoint appointment booking plugin – latepoint | calendar & scheduling for wordpress <= 5.7.3
Original advisory text
Appointment Booking Plugin <= 5.7.3 - Authenticated (Subscriber+) Sensitive Information Exposure in 'first_name' Parameter Template Re-expansion
The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.7.3 via the 'params[customer][first_name]' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract privileged booking data including the administrator-only admin_notes field, assigned agent internal contact details, transaction tokens, and payment request URLs delivered via rendered notification emails. A LatePoint customer can exploit this by storing a template placeholder such as {{customer_admin_notes}} in their own first_name field via the customer_cabinet__update route, then triggering the password-reset email flow to receive the expanded value in the resulting notification.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
4.3 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-200Information Exposure
Timeline
Published14 Oct 2026
Updated31 Oct 2026
First seen14 Oct 2026
Sources
CVE-2026-103380 · NVD
CVE-2026-103380 · MITRE
Track software like this
Free during beta