CVE-2026-9719: LatePoint WordPress Plugin CSRF Vulnerability

CVE-2026-9719 Overview

CVE-2026-9719 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress. The flaw exists in all versions up to and including 5.6.0. The vulnerability stems from missing or incorrect nonce validation on the change_status function within the invoices controller. Unauthenticated attackers can change the status of arbitrary invoices, including marking unpaid invoices as paid, by tricking a site administrator into clicking a crafted link. The issue is tracked under CWE-352.

Critical Impact
Attackers can manipulate invoice status — including converting unpaid invoices to paid — by abusing an authenticated administrator's session through a forged request.

Affected Products

LatePoint – Calendar Booking Plugin for Appointments and Events for WordPress
All versions up to and including 5.6.0
WordPress sites using the vulnerable invoices_controller.phpchange_status handler

Discovery Timeline

2026-06-06 - CVE-2026-9719 published to NVD
2026-06-08 - Last updated in NVD database

Technical Details for CVE-2026-9719

Vulnerability Analysis

The LatePoint plugin exposes an invoice management workflow that allows administrators to update the status of issued invoices. The change_status action in invoices_controller.php accepts state-changing requests without validating a WordPress nonce token. As a result, the endpoint trusts any authenticated request reaching it, including requests triggered from an external origin while an administrator session is active.

The vulnerability requires user interaction, typically the administrator clicking a link or loading a page controlled by the attacker. The forged request executes in the administrator's browser context and reaches the plugin's invoice handler with valid session cookies. Because the request modifies invoice state rather than disclosing data, the impact is integrity-focused — for example, an attacker can mark unpaid invoices as paid and disrupt the booking platform's billing records.

Root Cause

The root cause is the absence of a valid CSRF token (WordPress nonce) check in the change_status function. Code references in lib/controllers/invoices_controller.php around lines 234 and 246 and the parameter parsing in lib/helpers/params_helper.php show the status mutation path without an accompanying check_admin_referer or wp_verify_nonce call tied to the action. This maps to CWE-352: Cross-Site Request Forgery.

Attack Vector

Exploitation is network-based and requires no privileges on the target site. The attacker hosts or distributes a page containing an auto-submitting form or image tag that issues a request to the vulnerable LatePoint endpoint. When a logged-in WordPress administrator visits the attacker-controlled resource, the browser attaches authentication cookies, and the plugin processes the invoice status change. The vendor-patched code is available in WordPress LatePoint Changeset 3553094.

No verified public proof-of-concept code is available. The vulnerability mechanism is documented in the Wordfence Vulnerability Report and the affected handler is visible in the LatePoint 5.6.0 invoices controller source.

Detection Methods for CVE-2026-9719

Indicators of Compromise

Unexpected transitions of invoice records from unpaid to paid without corresponding payment gateway events.
HTTP requests to the LatePoint change_status action containing a Referer header pointing to an external, non-administrative origin.
Administrator account activity in WordPress logs immediately following navigation to an unfamiliar URL or email link.

Detection Strategies

Review web server access logs for POST or GET requests to LatePoint invoice endpoints where the Referer header is missing, empty, or external.
Correlate WordPress audit logs of invoice state changes against payment processor transaction records to identify unbacked status flips.
Hunt for repeated change_status calls originating from a single administrator session within a short interval.

Monitoring Recommendations

Enable a WordPress activity logging plugin to record invoice modifications with user, IP, and referer metadata.
Forward web server and application logs to a centralized SIEM and alert on LatePoint invoice mutations lacking a valid same-origin Referer.
Monitor administrator accounts for anomalous browsing patterns preceding invoice state changes.

How to Mitigate CVE-2026-9719

Immediate Actions Required

Update the LatePoint plugin to the version released in changeset 3553094 or later, which adds nonce validation to the change_status action.
Audit all invoices for unauthorized status transitions since the plugin was installed and reconcile against payment gateway records.
Force re-authentication for administrator accounts and rotate session cookies after patching.

Patch Information

The vendor addressed the missing nonce validation in the LatePoint plugin source tree. The fix is documented in WordPress LatePoint Changeset 3553094. Administrators running version 5.6.0 or earlier must upgrade to the patched release. Refer to the Wordfence Vulnerability Report for vendor advisory details.

Workarounds

Restrict access to /wp-admin using IP allowlists or a web application firewall rule until the plugin is updated.
Deploy a WAF signature that blocks requests to the LatePoint change_status action when the Referer header is absent or off-origin.
Instruct administrators to log out of WordPress sessions before browsing untrusted links or email content.

bash

# Example nginx rule to block off-origin requests to the vulnerable endpoint
location ~* /wp-admin/admin-ajax.php {
    if ($http_referer !~* "^https?://your-site\.example/") {
        return 403;
    }
}