CVE-2026-18441: LatePoint WordPress Plugin IDOR Vulnerability

CVE-2026-18441 Overview

CVE-2026-18441 is an Insecure Direct Object Reference (IDOR) vulnerability in the Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress. The flaw affects all versions up to and including 5.6.9 and resides in the set_customer_object function due to missing validation on a user-controlled key. Unauthenticated attackers can enumerate arbitrary customer records by iterating the customer[id] parameter. Successful exploitation discloses personally identifiable information (PII), including first name, last name, email address, and phone number. The issue is exploitable only when the site is configured with customer authentication disabled (guest checkout enabled).

Critical Impact
Unauthenticated attackers can enumerate customer records and harvest PII on WordPress sites running LatePoint with guest checkout enabled.

Affected Products

LatePoint – Appointment Booking Plugin for WordPress (all versions ≤ 5.6.9)
WordPress sites with LatePoint guest checkout enabled
LatePoint deployments with customer authentication disabled

Discovery Timeline

2026-09-18 - CVE-2026-18441 published to NVD
2026-09-19 - Last updated in NVD database

Technical Details for CVE-2026-18441

Vulnerability Analysis

The vulnerability is an Insecure Direct Object Reference (IDOR) classified under [CWE-639]. The LatePoint plugin exposes the set_customer_object code path during the booking workflow. The function accepts a customer[id] value from the request without verifying that the requester is authorized to access the referenced record.

Because the plugin allows guest checkout, the booking steps are reachable without authentication. An attacker can iterate numeric customer[id] values and receive responses populated with each customer's stored profile data. This turns a normal booking flow into an unauthenticated PII enumeration primitive.

The disclosed fields include first name, last name, email address, and phone number for every stored customer record. Impacted deployments effectively leak the plugin's entire customer database to any anonymous visitor who can reach the booking endpoint.

Root Cause

The root cause is missing authorization on a user-controlled object key. The plugin trusts the customer[id] value supplied in the request and loads the corresponding record without confirming the requester owns or is otherwise entitled to that customer object. Relevant source paths include latepoint.php, lib/controllers/steps_controller.php, lib/helpers/steps_helper.php, and lib/models/model.php in the 5.6.9 tag on the WordPress plugin repository. See the Wordfence Vulnerability Report for additional context.

Attack Vector

The attack vector is network-based and requires no user interaction. An attacker sends crafted booking-step requests to the LatePoint endpoint, incrementing the customer[id] parameter across the numeric range. Each response returns the customer object bound to that identifier. Automated scripts can iterate identifiers in bulk to exfiltrate large PII sets. Exploitation requires that the target site has customer authentication disabled and guest checkout enabled.

The vulnerability mechanism is documented in the referenced plugin source. See the LatePoint Steps Controller Code and LatePoint Model Code Snippet for technical details.

Detection Methods for CVE-2026-18441

Indicators of Compromise

Repeated POST requests to LatePoint booking step endpoints from a single client with sequentially incrementing customer[id] values.
Unusual volume of booking-flow requests that do not culminate in completed appointments.
Web server access logs showing enumeration patterns against /wp-admin/admin-ajax.php or LatePoint front-end booking routes.

Detection Strategies

Inspect HTTP request bodies and query strings for the customer[id] parameter and alert on rapid numeric iteration from a single source.
Correlate booking-step requests with completion events; a high ratio of step requests to bookings signals abuse.
Deploy WordPress security plugin rules that flag unauthenticated access to LatePoint customer object handlers.

Monitoring Recommendations

Enable verbose HTTP access logging on the WordPress front end and forward logs to a centralized analytics platform.
Monitor egress data volumes from the WordPress server for anomalies consistent with bulk PII exfiltration.
Track authentication configuration changes in the LatePoint settings that toggle guest checkout state.

How to Mitigate CVE-2026-18441

Immediate Actions Required

Upgrade LatePoint to a version above 5.6.9 as soon as a patched release is available from the vendor.
Disable guest checkout and require customer authentication until the site is patched.
Audit recent web server logs for evidence of customer[id] enumeration and notify affected customers if PII exposure is confirmed.

Patch Information

The vulnerability is present in LatePoint versions up to and including 5.6.9. Site administrators should monitor the WordPress plugin repository and the Wordfence Vulnerability Report for the fixed release and apply it once available.

Workarounds

Re-enable required customer authentication in LatePoint settings to remove the unauthenticated attack surface.
Deploy a Web Application Firewall (WAF) rule that blocks requests iterating customer[id] values from unauthenticated clients.
Restrict access to the booking endpoints by IP allowlisting where feasible until the plugin is upgraded.

bash

# Example WAF rule (ModSecurity syntax) to rate-limit customer[id] enumeration
SecRule ARGS:'customer[id]' "@rx ^[0-9]+$" \
    "id:1026184410,\
     phase:2,\
     deny,\
     status:429,\
     msg:'Possible LatePoint IDOR enumeration (CVE-2026-18441)',\
     chain"
    SecRule IP:REQ_COUNT "@gt 20"