CVE-2026-111602: LatePoint WordPress Plugin Data Leak

CVE-2026-111602 Overview

CVE-2026-111602 is a sensitive information exposure vulnerability [CWE-200] affecting the LatePoint Appointment Booking plugin for WordPress through version 5.7.4. The flaw resides in the params (customer[uuid]) parameter processed by the unauthenticated steps__load_step AJAX endpoint. Unauthenticated attackers can enumerate customer UUID prefixes to extract first names, last names, email addresses, phone numbers, and notes from every customer record. Exploitation requires the plugin to be configured with the Field used for authentication setting set to Disable ability to login, which enables guest checkout mode.

Critical Impact
Unauthenticated extraction of full customer personally identifiable information (PII) from the LatePoint database when guest checkout mode is enabled.

Affected Products

LatePoint – Appointment Booking Plugin for WordPress, all versions through 5.7.4
Deployments configured with Field used for authentication set to Disable ability to login
WordPress sites using LatePoint for scheduling and customer management

Discovery Timeline

2026-10-17 - CVE-2026-111602 published to NVD
2026-10-19 - Last updated in NVD database

Technical Details for CVE-2026-111602

Vulnerability Analysis

The LatePoint plugin exposes an unauthenticated AJAX action named steps__load_step that accepts a nested customer[uuid] parameter. The backend logic in steps_controller.php and steps_helper.php uses this parameter to look up customer records without requiring an exact UUID match. Instead, the lookup accepts a UUID prefix, which the underlying model query in model.php treats as a partial match. An attacker can iterate across short UUID prefixes and observe response differences to progressively enumerate valid customer identifiers. Each confirmed prefix returns record data including first name, last name, email, phone, and notes.

Root Cause

The root cause is insufficient validation on the customer[uuid] input combined with a model lookup that returns record fields when a partial identifier matches. The params_helper.php logic does not enforce an exact UUID format, and the controller does not require authentication for the step-loading flow in guest checkout mode. This design allows prefix-based enumeration against the customer dataset.

Attack Vector

Exploitation occurs over the network against the WordPress admin-ajax.php endpoint without authentication. The attacker issues repeated POST requests to the steps__load_step action, varying the customer[uuid] value across short hex prefixes. Responses that correspond to a valid customer prefix reveal the stored PII fields. The attack requires the plugin to be configured for guest checkout mode, which is why the Common Vulnerability Scoring System (CVSS) vector reflects high attack complexity.

No public proof-of-concept code has been published. See the Wordfence Vulnerability Analysis and the WordPress LatePoint Steps Controller source for technical details.

Detection Methods for CVE-2026-111602

Indicators of Compromise

High-volume POST requests to /wp-admin/admin-ajax.php with action=steps__load_step from a single source address
Repeated requests containing the customer[uuid] parameter with short or incrementing hexadecimal values
Response bodies to anonymous requests that include customer PII fields such as email or phone number

Detection Strategies

Baseline normal traffic volume to the steps__load_step AJAX action and alert on sustained enumeration bursts.
Inspect web server access logs for requests where customer[uuid] values do not match the full UUID format produced by legitimate booking flows.
Correlate unauthenticated AJAX activity against the WordPress host with outbound data patterns suggesting bulk extraction.

Monitoring Recommendations

Forward WordPress and web server logs to a centralized logging platform for retention and query.
Enable rate-limit alerts on admin-ajax.php for unauthenticated sessions targeting the LatePoint action.
Monitor the plugin's authentication configuration for changes to the Field used for authentication setting.

How to Mitigate CVE-2026-111602

Immediate Actions Required

Upgrade LatePoint to version 5.7.5 or later, which contains the vendor fix in steps_controller.php.
If immediate upgrade is not possible, change the Field used for authentication setting away from Disable ability to login to remove the exploitable configuration.
Review customer records for signs of mass access and notify affected individuals if data exposure is confirmed.

Patch Information

The vendor addressed the issue in LatePoint 5.7.5. The updated controller enforces stricter handling of the customer[uuid] parameter in the step-loading flow. Refer to the WordPress LatePoint Steps Controller 5.7.5 source for the corrected implementation.

Workarounds

Disable guest checkout mode by selecting an authentication field other than Disable ability to login.
Deploy a web application firewall (WAF) rule to block unauthenticated requests to admin-ajax.php with action=steps__load_step and short customer[uuid] values.
Temporarily deactivate the LatePoint plugin on sites that cannot be patched or reconfigured.

bash

# WAF rule concept: block short UUID prefixes on the vulnerable AJAX action
# Pseudocode for a reverse proxy or WAF
if request.path == "/wp-admin/admin-ajax.php" \
    and request.body contains "action=steps__load_step" \
    and length(request.param["customer[uuid]"]) < 36:
    deny