Appointment Booking Plugin <= 5.7.1 - Insecure Direct Object Reference to Unauthenticated Unauthorized Transaction Intent Creation/Modification and Invoice Enumeration via 'invoice_id' Parameter

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-94432 · Microsoft / collected KEV context

cve-program · CVE-2026-94432

• https://www.wordfence.com/threat-intel/vulnerabilities/id/e101bc4e-1c5d-4f30-a1eb-617b0db92723?source=cve
• https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.0/lib/controllers/paypal_connect_controller.php#L31
• https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.0/lib/controllers/paypal_connect_controller.php#L20
• https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.0/lib/helpers/transaction_intent_helper.php#L85
• https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.0/latepoint.php#L1072
• https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.0/lib/controllers/controller.php#L57
• https://plugins.trac.wordpress.org/changeset?reponame=&old=3709058%40latepoint&new=3709058%40latepoint

No related operational record is retained in the current change model.