CVE-2026-17538: LatePoint WordPress Plugin Auth Bypass Flaw

CVE-2026-17538 Overview

CVE-2026-17538 is an Insecure Direct Object Reference (IDOR) vulnerability in the LatePoint - Appointment Booking & Reservation plugin for WordPress. The flaw affects all versions up to and including 5.6.9. The process_step_customer() function relies solely on is_user_logged_in() as its authorization gate, omitting ownership validation before merging POST data into existing LatePoint customer records. Authenticated attackers with Subscriber-level access can modify personal information belonging to arbitrary LatePoint customers. When the contact_merge setting is configured to phone, attackers can overwrite a victim's email address and trigger a password reset to seize the account. The vulnerability is tracked under [CWE-639].

Critical Impact
Subscriber-level attackers can modify arbitrary LatePoint customer records and achieve full account takeover when contact_merge is set to phone.

Affected Products

LatePoint - Appointment Booking & Reservation plugin for WordPress
All versions up to and including 5.6.9
WordPress sites configured with contact_merge set to phone (elevated impact)

Discovery Timeline

2026-10-08 - CVE-2026-17538 published to NVD
2026-10-10 - Last updated in NVD database

Technical Details for CVE-2026-17538

Vulnerability Analysis

The LatePoint plugin exposes a customer update workflow through the process_step_customer() function. This function processes POSTed customer data and merges it into existing LatePoint customer records. The function treats any authenticated session as sufficient authorization to write to any customer record targeted by the request.

Attackers with Subscriber-level accounts, the lowest standard WordPress role, can submit crafted requests to overwrite the first name, last name, email, phone, and notes of any LatePoint customer. The impact escalates when the plugin's contact_merge setting is configured to phone. In that configuration, the attacker can overwrite a victim's email address while preserving record linkage via phone number, then initiate a WordPress password reset to receive the reset email and take over the account.

Root Cause

The root cause is a missing ownership check in process_step_customer(). The function uses is_user_logged_in() as its sole access control gate. It never verifies that the authenticated user owns the LatePoint customer record identified in the request. This maps directly to [CWE-639]: Authorization Bypass Through User-Controlled Key.

Attack Vector

Exploitation requires an authenticated session with Subscriber-level privileges or higher. The attacker submits a POST request to the LatePoint customer processing endpoint, supplying the target customer identifier along with replacement field values. Because no ownership validation occurs, the server merges the attacker-controlled values into the targeted record. For account takeover, the attacker swaps the victim's email, then uses the standard WordPress wp-login.php?action=lostpassword flow to receive a password reset link. See the Wordfence Vulnerability Analysis for additional technical context.

Detection Methods for CVE-2026-17538

Indicators of Compromise

Unexpected changes to LatePoint customer email, phone, first name, last name, or notes fields with no corresponding admin audit entry.
Password reset emails delivered to addresses that do not match the historical account owner.
Subscriber-role accounts issuing POST requests to LatePoint customer processing endpoints.
New or recently registered low-privilege WordPress users immediately interacting with customer workflows.

Detection Strategies

Review web server logs for POST requests to LatePoint endpoints originating from Subscriber-level sessions.
Compare current LatePoint customer records against database backups to identify silent email or phone modifications.
Alert on WordPress password_reset events that follow a recent customer email change within a short time window.

Monitoring Recommendations

Enable WordPress audit logging for user profile and plugin data modifications.
Forward WordPress and web server logs to a centralized analytics platform for correlation of customer edits with authentication events.
Monitor for anomalous registration patterns followed by immediate interaction with booking endpoints.

How to Mitigate CVE-2026-17538

Immediate Actions Required

Update the LatePoint plugin to a version later than 5.6.9 as soon as a patched release is available.
Audit LatePoint customer records for unauthorized changes to email, phone, and notes fields.
Review recent password reset events against the audit log and force resets on any suspect accounts.
Restrict new user registration or temporarily disable the Subscriber role on affected sites.

Patch Information

A plugin code change addressing this issue is tracked in the WordPress Plugin Changeset. Site administrators should apply the vendor-supplied update through the WordPress plugin dashboard once the fixed version is listed. Confirm the installed version is greater than 5.6.9 after updating.

Workarounds

Change the LatePoint contact_merge setting away from phone to limit the account takeover path via email overwrite.
Disable open user registration on the WordPress site until the plugin is patched.
Place a Web Application Firewall rule in front of LatePoint customer endpoints to block requests from Subscriber-role sessions targeting customer identifiers they do not own.
Remove or deactivate the LatePoint plugin if booking functionality is not business-critical during the patch window.

bash

# Verify installed LatePoint plugin version via WP-CLI
wp plugin get latepoint --field=version

# Update to the latest patched release
wp plugin update latepoint

# Temporarily disable new user registration site-wide
wp option update users_can_register 0