CVE-2026-13471: LatePoint WordPress Plugin IDOR Vulnerability

CVE-2026-13471 Overview

The LatePoint – Calendar Booking Plugin for Appointments and Events for WordPress contains an Insecure Direct Object Reference (IDOR) vulnerability [CWE-639]. The flaw affects all versions up to and including 5.6.3 and resides in the LatePointAbilityDeleteBooking::execute handler. Missing validation on a user-controlled key allows authenticated attackers with Agent-level access or above to read bookings belonging to other agents and delete arbitrary bookings by supplying any booking ID. Exposed data includes customer personally identifiable information (PII) such as full name, email, phone, and notes. Exploitation requires an administrator to have enabled one or more Abilities API toggles (latepoint_abilities_api, latepoint_abilities_api_delete, latepoint_abilities_api_edit).

Critical Impact
Authenticated LatePoint agents can read cross-agent bookings containing customer PII and delete arbitrary bookings when the Abilities API is enabled.

Affected Products

LatePoint – Calendar Booking Plugin for Appointments and Events for WordPress, versions up to and including 5.6.3
WordPress installations with the LatePoint Abilities API enabled via plugin settings
Sites where multiple LatePoint agents share the booking system

Discovery Timeline

2026-09-18 - CVE-2026-13471 published to the National Vulnerability Database (NVD)
2026-09-18 - Last updated in NVD database

Technical Details for CVE-2026-13471

Vulnerability Analysis

The vulnerability is an Insecure Direct Object Reference in the LatePoint Abilities API. When an administrator enables the Abilities API through the plugin settings, LatePoint exposes booking-management endpoints intended for agent workflows. The LatePointAbilityDeleteBooking::execute method accepts a booking identifier from the request but fails to verify that the requesting agent owns the referenced booking. The same authorization gap applies to booking and customer listing abilities.

As a result, any authenticated agent can supply arbitrary booking IDs to enumerate other agents' bookings and issue deletion requests against records outside their assignment. The impact is limited to confidentiality of booking data and integrity through unauthorized deletion; the vulnerability does not directly grant code execution or affect availability of the WordPress host.

Root Cause

The abilities layer performs capability checks that confirm the caller holds LatePoint Agent privileges, but it does not perform an ownership check tying the target booking to the requesting agent. The user-controlled booking key is trusted verbatim when locating the record for read and delete operations. Reference implementations of the affected handlers are documented in the LatePoint Delete Booking Code and the LatePoint List Bookings Code.

Attack Vector

An attacker authenticates to WordPress with a LatePoint Agent role or higher. The attacker then invokes the Abilities API endpoints for listing bookings, listing customers, or deleting a booking, substituting booking identifiers that belong to other agents. See the Wordfence Vulnerability Report for additional analysis. Exploitation is only possible when the administrator has enabled at least one of latepoint_abilities_api, latepoint_abilities_api_delete, or latepoint_abilities_api_edit.

No verified proof-of-concept code has been published. The vulnerability mechanism is a missing authorization check on a numeric or string booking key passed in the request body; no crafted payload or special formatting is required beyond a valid agent session and a target booking ID.

Detection Methods for CVE-2026-13471

Indicators of Compromise

Unexpected delete-booking invocations in LatePoint request logs originating from Agent accounts that are not assigned to the referenced booking.
Booking records missing from the database without corresponding administrator or owner-agent activity.
Bulk enumeration patterns against the LatePoint list-bookings or list-customers endpoints from a single agent session.

Detection Strategies

Audit WordPress application logs for LatePoint Abilities API calls where the calling agent_id does not match the agent_id associated with the returned booking.
Correlate WordPress user activity with LatePoint audit records to identify agents accessing bookings outside their assigned customers.
Alert on high-volume sequential booking ID access patterns that indicate enumeration behavior.

Monitoring Recommendations

Forward WordPress and web server logs to a centralized analytics platform and retain access records for the LatePoint plugin endpoints.
Monitor changes to the plugin configuration options latepoint_abilities_api, latepoint_abilities_api_delete, and latepoint_abilities_api_edit.
Track deletion events against the LatePoint bookings table and reconcile them against expected agent workflows.

How to Mitigate CVE-2026-13471

Immediate Actions Required

Update the LatePoint plugin to the version released in the LatePoint Changeset Update that supersedes 5.6.3.
Review the list of accounts holding LatePoint Agent role or higher and remove unnecessary privileges.
Disable the Abilities API toggles in plugin settings if agent-side API access is not required.
Audit recent booking deletions and cross-agent access to determine whether exploitation has occurred.

Patch Information

The vendor addressed the issue in the LatePoint update tracked by the LatePoint Changeset Update. Administrators should apply the update through the WordPress plugin manager and verify the installed version is greater than 5.6.3. Refer to the Wordfence Vulnerability Report for advisory details.

Workarounds

Set latepoint_abilities_api, latepoint_abilities_api_delete, and latepoint_abilities_api_edit to disabled in the LatePoint plugin settings until the patch is applied.
Restrict Agent role assignments to trusted staff and require multi-factor authentication for all WordPress accounts with LatePoint access.
Place the WordPress admin and REST endpoints behind a web application firewall to log and rate-limit access to LatePoint Abilities API routes.

bash

# Configuration example: disable LatePoint Abilities API toggles via WP-CLI
wp option update latepoint_abilities_api 0
wp option update latepoint_abilities_api_delete 0
wp option update latepoint_abilities_api_edit 0

# Verify current values
wp option get latepoint_abilities_api
wp option get latepoint_abilities_api_delete
wp option get latepoint_abilities_api_edit