{"id":"CVE-2026-105256","aliases":["EUVD-2026-107145","GHSA-5qmh-x48w-jf3f"],"status":"published","title":"LatePoint \u003c 5.7.5 - Unauthenticated Payment Bypass via 'payment_portion' Parameter","description":"The LatePoint WordPress plugin before 5.7.5 does not validate the client-supplied value that determines how much is charged for a booking against the amounts the service and site actually allow, allowing an unauthenticated visitor to make the amount due resolve to zero and obtain a confirmed appointment and a recorded order without completing any payment.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.0014,"percentile":0.03456,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-345"],"published":"2026-10-21T08:38:58Z","modified":"2026-10-21T18:37:38Z","products":[{"vendor":"latepoint","product":"latepoint"},{"vendor":"unknown","product":"latepoint"}],"references":[{"url":"https://wpscan.com/vulnerability/53a81b39-e86b-4b73-8b4f-64746684055d/","tags":["exploit","vdb-entry","technical-description"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105256"},{"url":"https://wpscan.com/vulnerability/53a81b39-e86b-4b73-8b4f-64746684055d"},{"url":"https://github.com/advisories/GHSA-5qmh-x48w-jf3f"}],"sources":{"cve":[{"id":"CVE-2026-105256","title":"LatePoint \u003c 5.7.5 - Unauthenticated Payment Bypass via 'payment_portion' Parameter","description":"The LatePoint WordPress plugin before 5.7.5 does not validate the client-supplied value that determines how much is charged for a booking against the amounts the service and site actually allow, allowing an unauthenticated visitor to make the amount due resolve to zero and obtain a confirmed appointment and a recorded order without completing any payment.","status":"published","published":"2026-10-21T08:38:58.118Z","modified":"2026-10-21T10:14:55.218Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-345"],"updated_at":"2026-11-02T14:19:56.755658Z"}],"euvd":[{"id":"EUVD-2026-107145","description":"The LatePoint WordPress plugin before 5.7.5 does not validate the client-supplied value that determines how much is charged for a booking against the amounts the service and site actually allow, allowing an unauthenticated visitor to make the amount due resolve to zero and obtain a confirmed appointment and a recorded order without completing any payment.","status":"published","published":"2026-10-21T08:38:58Z","modified":"2026-10-21T10:14:55Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:59:40.152045Z"}],"ghsa":[{"id":"GHSA-5qmh-x48w-jf3f","title":"The LatePoint WordPress plugin before 5.7.5 does not validate the client-supplied value that...","description":"The LatePoint WordPress plugin before 5.7.5 does not validate the client-supplied value that determines how much is charged for a booking against the amounts the service and site actually allow, allowing an unauthenticated visitor to make the amount due resolve to zero and obtain a confirmed appointment and a recorded order without completing any payment.","status":"published","published":"2026-10-21T09:30:29Z","modified":"2026-10-21T12:31:07Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-345"],"updated_at":"2026-11-02T15:14:09.697532Z"}],"nvd":[{"id":"CVE-2026-105256","description":"The LatePoint WordPress plugin before 5.7.5 does not validate the client-supplied value that determines how much is charged for a booking against the amounts the service and site actually allow, allowing an unauthenticated visitor to make the amount due resolve to zero and obtain a confirmed appointment and a recorded order without completing any payment.","status":"published","published":"2026-10-21T09:17:06.197Z","modified":"2026-10-21T18:37:38.7Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-345"],"updated_at":"2026-11-02T14:13:02.045979Z"}]}}