CVE-2026-11398: LatePoint Auth Bypass Vulnerability

CVE-2026-11398 Overview

CVE-2026-11398 is an authorization bypass vulnerability in the LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress. The flaw affects all versions up to and including 5.6.1. Unauthenticated attackers can modify personally identifiable information (PII) on any existing customer record, including administrator-linked accounts, by submitting the booking form with a known email address. Modifiable fields include first name, last name, phone number, and notes. Exploitation requires the plugin to be configured with guest bookings enabled, meaning is_customer_auth_disabled() returns true. The vulnerability is classified under CWE-862: Missing Authorization.

Critical Impact
Unauthenticated attackers can overwrite PII fields on any LatePoint customer record — including administrators — using only a known email address.

Affected Products

LatePoint – Calendar Booking Plugin for Appointments and Events (WordPress plugin)
All versions up to and including 5.6.1
Instances configured with guest bookings enabled (is_customer_auth_disabled() returns true)

Discovery Timeline

2026-07-03 - CVE-2026-11398 published to NVD
2026-07-06 - Last updated in NVD database

Technical Details for CVE-2026-11398

Vulnerability Analysis

The vulnerability resides in the LatePoint plugin's booking workflow, specifically in the process_step_customer() function within steps_controller.php. This handler processes customer data submitted during the multi-step booking flow. When guest bookings are enabled, the code path becomes reachable without authentication.

The controller accepts a customer email address and attempts to match it against existing customer records. If a match is found, the plugin updates the existing record with the submitted form data instead of rejecting the request or requiring proof of ownership. Attackers exploit this by submitting the booking form using a known target email address paired with attacker-controlled values for first_name, last_name, phone, and notes.

The impact is limited to integrity of PII fields. The vulnerability does not permit password changes, email modification, or direct account takeover. However, altering administrator contact details or injecting content into the notes field can support downstream social engineering and phishing operations.

Root Cause

The root cause is missing authorization enforcement [CWE-862]. The process_step_customer() handler treats email address as an implicit identity claim. It never verifies that the submitter owns the email or possesses a valid session tied to that customer. Related logic in steps_helper.php at lines 1892, 1953, and 1980 performs the record lookup and update without an ownership check.

Attack Vector

Exploitation is remote and unauthenticated. An attacker sends a crafted POST request to the LatePoint booking endpoint, supplying a target victim's email address and the desired replacement values. The plugin locates the existing customer record and overwrites the mutable PII fields. No user interaction from the victim is required. The prerequisite is that the site administrator has enabled guest bookings, which is a common default for public-facing appointment scheduling.

See the vulnerable steps controller and the steps helper update logic for the specific code paths.

Detection Methods for CVE-2026-11398

Indicators of Compromise

Unexpected changes to customer records in the LatePoint database tables, particularly to first_name, last_name, phone, or notes columns of admin-linked customer entries.
POST requests to LatePoint booking endpoints originating from unauthenticated sessions that reference existing customer email addresses.
Anomalous booking submissions containing suspicious content in the notes field, such as URLs, HTML, or phishing text.

Detection Strategies

Review WordPress access logs for high-volume or scripted POST requests to LatePoint step handlers, especially process_step_customer invocations.
Enable database auditing on the LatePoint customer table and alert on UPDATE statements that target administrator email accounts.
Correlate customer record modifications with the absence of a matching authenticated user session in web server logs.

Monitoring Recommendations

Baseline the normal rate of customer record updates and alert on statistical anomalies.
Ingest WordPress and web server logs into a centralized log analytics or SIEM platform to enable long-term retention and cross-source correlation.
Monitor the LatePoint plugin version deployed across managed WordPress sites and flag any instance still running 5.6.1 or earlier.

How to Mitigate CVE-2026-11398

Immediate Actions Required

Update the LatePoint plugin to the version that follows the WordPress LatePoint Changeset 3572632 patched release.
If patching is not immediately possible, disable guest bookings so that is_customer_auth_disabled() returns false and the vulnerable code path is unreachable.
Audit all existing customer records for unauthorized changes to first_name, last_name, phone, and notes fields, particularly for admin-linked accounts.

Patch Information

The vendor addressed the issue in the release documented in WordPress LatePoint Changeset 3572632. Additional analysis is available in the Wordfence Vulnerability Report.

Workarounds

Disable guest bookings in the LatePoint settings so authentication is required before a booking form submission can update a customer record.
Restrict access to the LatePoint booking endpoints using a Web Application Firewall (WAF) rule that requires an authenticated session cookie.
Place the booking page behind CAPTCHA or rate-limiting to reduce automated abuse targeting known administrator email addresses.

bash

# Configuration example - WAF rule concept to block unauthenticated LatePoint step submissions
# ModSecurity-style rule
SecRule REQUEST_URI "@contains /wp-admin/admin-ajax.php" \
  "chain,deny,status:403,id:1026114398,\
   msg:'Block unauthenticated LatePoint process_step_customer'"
  SecRule ARGS:action "@streq latepoint_route_call" "chain"
  SecRule ARGS:route_name "@streq steps__process_step_customer" "chain"
  SecRule &REQUEST_COOKIES:wordpress_logged_in "@eq 0"