{"id":"CVE-2026-103380","revision":"c3ef539c4552430591b17b221755ad04","records":[{"revision":"c3ef539c4552430591b17b221755ad04","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-103380","aliases":[],"title":"Appointment Booking Plugin <= 5.7.3 - Authenticated (Subscriber+) Sensitive Information Exposure in 'first_name' Parameter Template Re-expansion","description":"The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.7.3 via the 'params[customer][first_name]' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract privileged booking data including the administrator-only admin_notes field, assigned agent internal contact details, transaction tokens, and payment request URLs delivered via rendered notification emails. A LatePoint customer can exploit this by storing a template placeholder such as {{customer_admin_notes}} in their own first_name field via the customer_cabinet__update route, then triggering the password-reset email flow to receive the expanded value in the resulting notification.","state":0,"publishedAt":"2026-10-14T07:43:32.242+00:00","modifiedAt":"2026-10-15T16:43:49.346+00:00","affected":[{"ecosystem":"Vendor product","name":"Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"latepoint\",\n                    \"product\": \"Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress\",\n                    \"versions\": [\n                        {\n                            \"version\": \"0\",\n                            \"status\": \"affected\",\n                            \"lessThanOrEqual\": \"5.7.3\",\n                            \"versionType\": \"semver\"\n                        }\n                    ],\n                    \"defaultStatus\": \"unaffected\"\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","score":4.3,"severity":"MEDIUM"}],"references":["https://www.wordfence.com/threat-intel/vulnerabilities/id/4494960c-66ed-47d9-b3fc-5a5ec5a07b1f?source=cve","https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.3/lib/helpers/replacer_helper.php#L278","https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.3/lib/helpers/replacer_helper.php#L614","https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.3/lib/controllers/customer_cabinet_controller.php#L321","https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.3/lib/models/customer_model.php#L388","https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.3/lib/mailers/customer_mailer.php#L33","https://plugins.trac.wordpress.org/changeset?reponame=&old=3728691%40latepoint&new=3728691%40latepoint"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-103380","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-103380","identifiers":["CVE-2026-103380"]},"retained":false,"historicalAffected":[]}],"coverage":[]}