CVE-2026-103366: LatePoint WordPress Plugin IDOR Vulnerability

CVE-2026-103366 Overview

CVE-2026-103366 is an Insecure Direct Object Reference (IDOR) vulnerability in the Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress. The flaw affects all versions up to and including 5.7.3. Unauthenticated attackers can enumerate sequential booking[id] and cart[id] values to read other customers' appointment details and pending checkout contents. Exposed data includes service name, agent, date/time, duration, price breakdown, booking status, and shopping cart contents. The weakness is classified as [CWE-639: Authorization Bypass Through User-Controlled Key].

Critical Impact
Unauthenticated remote attackers can read arbitrary customer booking and cart records over public AJAX routes, exposing personally identifiable information and transaction data.

Affected Products

WordPress LatePoint Appointment Booking Plugin — all versions through 5.7.3
WordPress sites exposing wp_ajax_nopriv_latepoint_route_call
Deployments relying on the vendor's prior IDOR patch that only covered OsStepsHelper::load_step()

Discovery Timeline

2026-10-14 - CVE-2026-103366 published to NVD
2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-103366

Vulnerability Analysis

The vulnerability resides in LatePoint's step controller logic reachable through the public wp_ajax_nopriv_latepoint_route_call dispatcher. Two routes, steps__reload_booking_form_summary_panel and steps__start, invoke OsStepsHelper::set_required_objects() to hydrate the booking and cart objects for the current request. That helper forwards raw request parameters into set_booking_object() and set_cart_object(), which call OsModel::set_data() and load an arbitrary row by primary key. No ownership or session check is performed before returning the hydrated object in the JSON response.

Root Cause

The vendor previously added an ownership guard, but it was placed only inside OsStepsHelper::load_step(). Sibling routes that also expose booking data were never covered, and the cart[id] parameter was never validated at all. The underlying model loader trusts caller-supplied identifiers, violating the authorization expectations of the public endpoints.

Attack Vector

An unauthenticated attacker sends crafted POST requests to the WordPress AJAX endpoint, specifying arbitrary numeric values for booking[id] or cart[id]. Because LatePoint uses sequential primary keys, the attacker can iterate identifiers to enumerate the entire customer base. Each response reveals the full booking or cart object as serialized JSON, enabling bulk extraction of customer appointment data and in-progress checkout state.

For technical specifics, see the LatePoint steps controller, the steps helper source, and the vendor changeset.

Detection Methods for CVE-2026-103366

Indicators of Compromise

High-volume POST requests to /wp-admin/admin-ajax.php with action=latepoint_route_call and route_name=steps__reload_booking_form_summary_panel or steps__start
Sequential or incrementing values in booking[id] or cart[id] parameters from a single source address
Unauthenticated clients receiving JSON responses containing customer names, service details, or price breakdowns

Detection Strategies

Inspect WordPress access logs for repeated AJAX calls to the LatePoint routes without an authenticated session cookie
Correlate response sizes and parameter patterns to identify enumeration attempts across the booking and cart identifier spaces
Deploy web application firewall rules that rate-limit or block requests referencing latepoint_route_call from unauthenticated users

Monitoring Recommendations

Enable verbose request logging on the WordPress AJAX endpoint and forward logs to a centralized analytics platform
Alert on anomalous enumeration behavior such as monotonically increasing numeric parameters within a short time window
Monitor outbound JSON payload sizes from admin-ajax.php responses for sudden spikes indicating bulk data harvesting

How to Mitigate CVE-2026-103366

Immediate Actions Required

Update the LatePoint plugin to the version that extends the ownership guard beyond OsStepsHelper::load_step() to the affected sibling routes
Audit WordPress logs for prior enumeration of booking[id] and cart[id] parameters to assess exposure
Notify affected customers if evidence of mass identifier enumeration is found in historical access logs

Patch Information

The vendor fix is tracked in the LatePoint changeset. Administrators should upgrade to the first LatePoint release published after 5.7.3. See the Wordfence vulnerability analysis for additional remediation guidance.

Workarounds

Temporarily disable the LatePoint plugin until a patched version is deployed
Block unauthenticated access to admin-ajax.php requests with action=latepoint_route_call at the web application firewall layer
Apply strict rate limiting to the LatePoint AJAX routes to slow identifier enumeration attempts

bash

# Example ModSecurity rule to block unauthenticated LatePoint route calls
SecRule REQUEST_URI "@contains /wp-admin/admin-ajax.php" \
  "chain,id:1032026103366,phase:2,deny,status:403,msg:'Block LatePoint IDOR enumeration'"
  SecRule ARGS:action "@streq latepoint_route_call" \
    "chain"
    SecRule &REQUEST_COOKIES:/wordpress_logged_in_/ "@eq 0"