CVE-2026-5356: LatePoint Plugin Auth Bypass Vulnerability

CVE-2026-5356 Overview

The LatePoint Calendar Booking Plugin for WordPress contains an improper input validation vulnerability in its Stripe Connect payment processor. The flaw affects all versions up to and including 5.4.0. The payment processor accepts a client-supplied PaymentIntent ID without server-side verification of the amount or transaction context. Unauthenticated attackers can supply a previously succeeded PaymentIntent token to pay an arbitrary amount for bookings. This weakness is categorized as Improper Input Validation and maps to [CWE-862] Missing Authorization.

Critical Impact
Unauthenticated attackers can complete high-value bookings by replaying a low-value Stripe PaymentIntent token, resulting in financial loss to site operators.

Affected Products

LatePoint – Calendar Booking Plugin for Appointments and Events (WordPress plugin)
All versions up to and including 5.4.0
Sites using the plugin's Stripe Connect payment processor

Discovery Timeline

2026-07-08 - CVE-2026-5356 published to NVD
2026-07-08 - Last updated in NVD database

Technical Details for CVE-2026-5356

Vulnerability Analysis

The LatePoint plugin integrates with Stripe Connect to process payments for appointment and event bookings. During checkout, the plugin accepts a PaymentIntent identifier submitted by the client. The server-side handler treats the client-supplied ID as authoritative proof of payment. It does not validate that the referenced PaymentIntent matches the booking amount, currency, or session context.

An attacker can create a legitimate low-value PaymentIntent, complete it, and capture the resulting succeeded ID. The attacker then initiates a booking of arbitrary value and submits the previously captured PaymentIntent ID. The plugin queries Stripe, observes a succeeded status, and marks the booking as paid regardless of the actual amount paid.

Root Cause

The root cause is trust of client-supplied transaction identifiers without cross-verification. The Stripe API returns full PaymentIntent metadata including amount, currency, and metadata fields. The plugin's payment handler fails to compare these values against the booking record before confirming the transaction.

Attack Vector

Exploitation requires network access to the booking endpoint and no authentication or user interaction. An attacker completes a genuine minimum-value payment through any LatePoint-enabled site or their own Stripe account to obtain a succeeded PaymentIntent ID. The attacker then intercepts or crafts the booking confirmation request and substitutes the harvested PaymentIntent ID. The server confirms the booking as fully paid.

See the Wordfence Vulnerability Report for additional technical detail.

Detection Methods for CVE-2026-5356

Indicators of Compromise

Bookings in the LatePoint database marked as paid where the associated Stripe PaymentIntent amount does not match the booking price.
Repeated use of the same Stripe PaymentIntent ID across multiple booking records.
Booking confirmations originating from unauthenticated sessions with unusually high-value services.
Discrepancies between Stripe Dashboard payout totals and LatePoint reported revenue.

Detection Strategies

Reconcile every LatePoint booking against Stripe by comparing payment_intent.amount to the booking's expected price.
Query the LatePoint orders table for duplicate payment_intent_id values across distinct bookings.
Alert on booking confirmation HTTP requests that submit PaymentIntent IDs older than the current session.

Monitoring Recommendations

Enable webhook logging for Stripe payment_intent.succeeded events and correlate with LatePoint booking creation timestamps.
Monitor WordPress access logs for POST requests to LatePoint booking confirmation endpoints from unauthenticated sources.
Track anomalous booking volume or high-value bookings created without corresponding Stripe charges of equivalent value.

How to Mitigate CVE-2026-5356

Immediate Actions Required

Update the LatePoint plugin to the patched version above 5.4.0 as published in the WordPress Changeset Update.
Audit all LatePoint bookings created since deploying Stripe Connect and reconcile paid amounts against Stripe records.
Refund or void any bookings that show mismatched or duplicated PaymentIntent IDs.
Rotate Stripe API keys if unauthorized access to payment metadata is suspected.

Patch Information

The vendor addressed the vulnerability in the changeset published at plugins.trac.wordpress.org/changeset/3509569/latepoint. The fix moves PaymentIntent creation and amount validation to the server, ensuring the booking price is authoritative and the client cannot substitute an alternate PaymentIntent ID.

Workarounds

Disable the Stripe Connect payment processor in LatePoint settings until the patch is applied.
Switch temporarily to an alternate LatePoint-supported payment gateway that performs server-side amount validation.
Place the booking endpoint behind a Web Application Firewall rule that blocks requests containing client-supplied payment_intent parameters.

bash

# Configuration example: WP-CLI update to patched version
wp plugin update latepoint --version=5.4.1
wp plugin list --name=latepoint --fields=name,status,version