CVE-2026-1537: LatePoint WordPress Information Disclosure

CVE-2026-1537 Overview

The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress contains an authorization bypass vulnerability due to a missing capability check on the load_step() function. This vulnerability affects all versions up to and including 5.2.6. The flaw allows unauthenticated attackers to access sensitive booking information including customer names, email addresses, phone numbers, appointment times, and service details.

Critical Impact

Unauthenticated attackers can extract sensitive customer PII including names, email addresses, phone numbers, and appointment details from WordPress sites running vulnerable versions of the LatePoint plugin.

Affected Products

• LatePoint – Calendar Booking Plugin for Appointments and Events versions up to and including 5.2.6
• WordPress installations with LatePoint plugin enabled

Discovery Timeline

• February 12, 2026 - CVE-2026-1537 published to NVD
• February 12, 2026 - Last updated in NVD database

Technical Details for CVE-2026-1537

Vulnerability Analysis

This vulnerability is classified as CWE-862: Missing Authorization. The core issue stems from the absence of proper capability checks within the load_step() function, which is responsible for handling booking workflow steps. Without adequate authorization verification, the function processes requests from any user, including unauthenticated visitors, allowing direct access to booking data that should be restricted to authenticated administrators or authorized personnel only.

The attack can be executed remotely over the network without requiring any user interaction or authentication credentials. The vulnerability specifically impacts data confidentiality, enabling unauthorized read access to sensitive customer information stored within the booking system.

Root Cause

The root cause is a missing capability check in the load_step() function located in lib/helpers/steps_helper.php. WordPress plugins should implement authorization checks using functions like current_user_can() to verify that the requesting user has appropriate permissions before processing sensitive operations. In this case, the function fails to validate whether the requester has the necessary capabilities, creating an authorization bypass condition.

Additionally, the related model code in lib/models/model.php appears to lack proper access controls when retrieving booking records, compounding the authorization issue.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker can craft HTTP requests directly to the vulnerable endpoint to retrieve booking information. The exploitation flow involves:

1. Identifying a WordPress site running a vulnerable version of LatePoint plugin
2. Sending crafted requests to the load_step() function endpoint
3. Extracting booking data including customer PII from the response

The vulnerability details and affected code paths can be reviewed at the WordPress LatePoint Code Reference and WordPress LatePoint Model Code Reference.

Detection Methods for CVE-2026-1537

Indicators of Compromise

• Unusual HTTP requests targeting LatePoint plugin endpoints from unauthenticated sources
• Anomalous access patterns to booking-related AJAX handlers
• Large volumes of data retrieval requests from single IP addresses
• Access log entries showing repeated calls to load_step endpoints without session cookies

Detection Strategies

• Monitor web server logs for requests to LatePoint AJAX endpoints from unauthenticated sessions
• Implement Web Application Firewall (WAF) rules to detect and block suspicious parameter patterns targeting the booking system
• Review access logs for bulk data extraction attempts characterized by sequential or automated request patterns
• Deploy intrusion detection signatures to identify known exploitation attempts against WordPress booking plugins

Monitoring Recommendations

• Enable detailed logging for all WordPress AJAX requests, particularly those handled by the LatePoint plugin
• Configure alerts for failed authorization attempts or access to sensitive booking data endpoints
• Implement rate limiting on booking-related API endpoints to slow potential data harvesting
• Regularly audit access logs for patterns consistent with automated scanning or data scraping

How to Mitigate CVE-2026-1537

Immediate Actions Required

• Update the LatePoint plugin to a patched version that addresses the missing authorization check (versions newer than 5.2.6)
• Review web server access logs for evidence of exploitation prior to patching
• Consider temporarily disabling the LatePoint plugin if an immediate update is not available
• Notify affected customers if evidence of unauthorized data access is discovered

Patch Information

Organizations should update to the latest version of the LatePoint plugin that includes proper authorization checks for the load_step() function. The vulnerability was disclosed through Wordfence Threat Intelligence, which provides additional details and remediation guidance.

Check for updates through the WordPress plugin management interface or download the latest version directly from the WordPress plugin repository.

Workarounds

• Implement WAF rules to block unauthenticated requests to LatePoint AJAX endpoints until the plugin can be updated
• Use WordPress security plugins to add additional authorization layers for sensitive plugin functions
• Restrict access to WordPress AJAX handlers at the web server level for unauthenticated users where feasible
• Consider temporarily limiting plugin functionality to authenticated users only through custom access control measures

# Example Apache .htaccess rule to restrict LatePoint AJAX access
<FilesMatch "admin-ajax\.php">
    <If "%{QUERY_STRING} =~ /action=latepoint/">
        Require user authenticated_user
    </If>
</FilesMatch>