Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-13471

Appointment Booking Plugin – LatePoint | Calendar & Scheduling… · Vulnerability

CVSS 3.1 4.3 MEDIUMCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-13471

Published

The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.6.3 via the LatePointAbilityDeleteBooking::execute due to missing validation on a user controlled key. This makes it possible for attackers, with LatePoint Agent-level access and above, to read bookings and customer PII (full name, email, phone, and notes) assigned to other LatePoint agents, and delete arbitrary bookings by supplying any booking ID. This vulnerability is only exploitable when an administrator has enabled the Abilities API toggles (latepoint_abilities_api, latepoint_abilities_api_delete, and/or latepoint_abilities_api_edit) in the plugin settings.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-13471

Published

Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "latepoint",
                    "product": "Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress",
                    "versions": [
                        {
                            "version": "0",
                            "status": "affected",
                            "lessThanOrEqual": "5.6.3",
                            "versionType": "semver"
                        }
                    ],
                    "defaultStatus": "unaffected"
                }

Original source record · Cite this exact observation · Complete original publisher JSON