Appointment Booking Plugin <= 5.7.3 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'booking[id]' and 'cart[id]' Parameters

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-103366 · Microsoft / collected KEV context

cve-program · CVE-2026-103366

• https://www.wordfence.com/threat-intel/vulnerabilities/id/2f13d1ac-d1b4-4802-bee2-3622e84d7482?source=cve
• https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.3/lib/helpers/steps_helper.php#L1232
• https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.3/lib/helpers/steps_helper.php#L3228
• https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.3/lib/models/model.php#L580
• https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.3/lib/controllers/steps_controller.php#L145
• https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.3/lib/controllers/steps_controller.php#L290
• https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.3/lib/helpers/steps_helper.php#L234
• https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.3/latepoint.php#L1072
• https://plugins.trac.wordpress.org/changeset?reponame=&old=3728691%40latepoint&new=3728691%40latepoint

No related operational record is retained in the current change model.