Appointment Booking Plugin <= 5.7.0 - Unauthenticated Arbitrary Shortcode Execution via First/Last Name Field

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-92966 · Microsoft / collected KEV context

cve-program · CVE-2026-92966

• https://www.wordfence.com/threat-intel/vulnerabilities/id/c9a030c0-6129-40b0-81da-4c420929d198?source=cve
• https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.0/lib/helpers/blocks_helper.php#L234
• https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.0/lib/views/customer_cabinet/dashboard.php#L19
• https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.0/lib/models/customer_model.php#L386
• https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.1/lib/helpers/blocks_helper.php

No related operational record is retained in the current change model.