Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
3.7

LatePoint plugin may reveal customer data to anyone

CVE-2026-111602 · published 2 days ago
Summary

The LatePoint appointment booking plugin for WordPress can let anyone who is not logged in view the first name, last name, email, phone number, and notes of every customer if the site is set to guest checkout mode. This happens through a request that leaks information when the plugin’s customer identifier field is used. Switch off guest checkout or update the plugin to a version that fixes the issue to stop the data exposure.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
latepoint appointment booking plugin – latepoint | calendar & scheduling for wordpress <= 5.7.4
Original advisory text
Appointment Booking Plugin <= 5.7.4 - Unauthenticated Sensitive Information Disclosure via ORM Operator Injection in 'customer[uuid]' Parameter
The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.7.4 via the 'params (customer[uuid])' parameter. This makes it possible for unauthenticated attackers to extract the first name, last name, email address, phone number, and notes of every customer record in the database by enumerating uuid prefixes via the unauthenticated steps__load_step AJAX endpoint. This vulnerability is only exploitable when the LatePoint plugin is configured with the 'Field used for authentication' setting set to 'Disable ability to login' (guest checkout mode).
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
3.7 Low
Exploitation
<1% chance of attack within 30 days
Type
CWE-200Information Exposure
Timeline
Published17 Oct 2026
Updated18 Oct 2026
First seen17 Oct 2026
Sources
CVE-2026-111602 · NVD
CVE-2026-111602 · MITRE
Track software like this
Free during beta