CVE-2026-103380: LatePoint WordPress Plugin Data Leak Flaw

CVE-2026-103380 Overview

CVE-2026-103380 affects the LatePoint Appointment Booking Plugin for WordPress through version 5.7.3. The flaw allows authenticated users with subscriber-level access to extract privileged booking data by abusing template placeholder expansion in the params[customer][first_name] field. An attacker stores a placeholder such as {{customer_admin_notes}} in their own first name via the customer_cabinet__update route, then triggers the password-reset email flow. The notification email returns the expanded value, leaking administrator-only admin_notes, assigned agent contact details, transaction tokens, and payment request URLs. The issue is tracked under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.

Critical Impact
Low-privileged authenticated users can harvest administrator notes, internal agent details, payment tokens, and payment URLs across LatePoint tenants.

Affected Products

LatePoint – Appointment Booking Plugin for WordPress, versions up to and including 5.7.3
WordPress sites running LatePoint Calendar & Scheduling with customer cabinet enabled
Any LatePoint deployment where subscriber-level account creation is permitted

Discovery Timeline

2026-10-14 - CVE-2026-103380 published to NVD
2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-103380

Vulnerability Analysis

The LatePoint plugin renders customer notification emails using a template replacer that expands placeholders such as {{customer_admin_notes}}, {{agent_email}}, and {{transaction_token}} against the current customer context. The customer cabinet exposes an update endpoint that writes attacker-controlled strings into the first_name field without sanitizing or escaping template delimiters. When the mailer later composes an email that embeds the customer's first name, the replacer resolves the attacker-supplied placeholder as if it were a legitimate template directive.

This turns a profile field into a server-side template injection sink restricted to information disclosure. The expanded output includes data the subscriber would otherwise never see, including the administrator-only admin_notes field documented in the LatePoint customer model and the mailer flow in the customer mailer.

Root Cause

The replacer helper processes stored customer attributes without distinguishing between static strings and template directives. Logic in the replacer helper applies placeholder resolution to fields controlled by the end user, violating the principle that untrusted input must not be re-interpreted as code or template syntax.

Attack Vector

An authenticated subscriber submits a POST request to the customer_cabinet__update route with params[customer][first_name] set to a placeholder such as {{customer_admin_notes}}. The attacker then invokes the password-reset email flow. The mailer resolves the stored placeholder during template expansion and emails the attacker the privileged value tied to their customer record, including payment request URLs and transaction tokens.

No verified exploit code is published. See the Wordfence vulnerability report for additional technical context.

// No verified public exploit code available. Attack is described in prose above.

Detection Methods for CVE-2026-103380

Indicators of Compromise

Customer records whose first_name field contains double-brace template syntax such as {{customer_admin_notes}}, {{agent_email}}, or {{transaction_token}}.
Outbound notification emails whose rendered first-name token contains data that does not match any legitimate human name.
Password-reset email volume spikes originating from a small set of recently created subscriber accounts.

Detection Strategies

Query the LatePoint customer table for first_name values matching the regex \{\{[a-z_]+\}\} to surface stored placeholders.
Review WordPress access logs for POST requests to the customer_cabinet__update route followed by password-reset triggers from the same session.
Inspect the mail queue for notifications where the greeting line expands into structured content such as URLs, UUIDs, or email addresses.

Monitoring Recommendations

Alert on new subscriber registrations that update profile fields and request password resets within a short interval.
Forward WordPress and plugin logs to a centralized data lake and correlate customer profile edits with outbound mailer events.
Track changes to the LatePoint plugin version and confirm that hosts remain on patched builds after each WordPress update cycle.

How to Mitigate CVE-2026-103380

Immediate Actions Required

Upgrade the LatePoint plugin to the version published in the vendor changeset 3728691, which addresses the placeholder injection.
Audit existing customer records and strip any first_name or related profile values that contain {{ ... }} template syntax.
Rotate any payment tokens or transaction identifiers that may have been exposed through notification emails during the exposure window.

Patch Information

The vendor fix is tracked in the WordPress plugin repository changeset referenced above. Site administrators should apply the update through the WordPress plugin updater and verify that the installed LatePoint version is later than 5.7.3. Confirm the patched behavior by setting a placeholder in a test subscriber first_name and triggering the password-reset flow; the raw string should render without expansion.

Workarounds

Disable self-service subscriber registration on the LatePoint-enabled WordPress site until the plugin is updated.
Restrict access to the customer_cabinet__update route using a web application firewall rule that rejects requests containing {{ or }} in params[customer] fields.
Temporarily suppress password-reset and booking notification emails that embed customer-provided names until the patched release is deployed.

bash

# Example WAF rule concept - block template delimiters in LatePoint profile updates
# ModSecurity-style pseudocode
SecRule REQUEST_URI "@contains customer_cabinet__update" \
  "chain,deny,status:403,id:1032026103380,msg:'LatePoint CVE-2026-103380 placeholder injection attempt'"
  SecRule ARGS:"params[customer][first_name]" "@rx \{\{.*\}\}"