{"id":"CVE-2026-17538","aliases":["EUVD-2026-94652","GHSA-gw8m-rqgv-6j3j"],"status":"published","title":"Appointment Booking Plugin – LatePoint | Calendar \u0026 Scheduling for WordPress \u003c= 5.6.9 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Customer PII Modification","description":"The LatePoint - Appointment Booking \u0026 Reservation plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 5.6.9. This is due to the process_step_customer() function using is_user_logged_in() as the sole gate before merging POSTed customer data into an existing LatePoint customer, without any ownership checks. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify the personal information (first name, last name, email, phone, notes) of arbitrary LatePoint customers, and, when the contact_merge setting is 'phone', to overwrite the victim's email address and take over the account via a password reset.","severity":{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00151,"percentile":0.04352,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-639"],"published":"2026-10-07T23:27:12Z","modified":"2026-10-10T03:17:07Z","products":[{"vendor":"latepoint","product":"appointment booking plugin – latepoint | calendar \u0026 scheduling for wordpress"}],"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/83cdc51f-b5e1-42b9-972a-7e781f97b43e?source=cve"},{"url":"https://plugins.trac.wordpress.org/changeset/3631493/"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17538"},{"url":"https://plugins.trac.wordpress.org/changeset/3631493"},{"url":"https://github.com/advisories/GHSA-gw8m-rqgv-6j3j"}],"sources":{"cve":[{"id":"CVE-2026-17538","title":"Appointment Booking Plugin – LatePoint | Calendar \u0026 Scheduling for WordPress \u003c= 5.6.9 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Customer PII Modification","description":"The LatePoint - Appointment Booking \u0026 Reservation plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 5.6.9. This is due to the process_step_customer() function using is_user_logged_in() as the sole gate before merging POSTed customer data into an existing LatePoint customer, without any ownership checks. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify the personal information (first name, last name, email, phone, notes) of arbitrary LatePoint customers, and, when the contact_merge setting is 'phone', to overwrite the victim's email address and take over the account via a password reset.","status":"published","published":"2026-10-07T23:27:12.424Z","modified":"2026-10-10T02:50:49.302Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-639"],"updated_at":"2026-11-02T14:19:54.84674Z"}],"euvd":[{"id":"EUVD-2026-94652","description":"The LatePoint - Appointment Booking \u0026 Reservation plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 5.6.9. This is due to the process_step_customer() function using is_user_logged_in() as the sole gate before merging POSTed customer data into an existing LatePoint customer, without any ownership checks. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify the personal information (first name, last name, email, phone, notes) of arbitrary LatePoint customers, and, when the contact_merge setting is 'phone', to overwrite the victim's email address and take over the account via a password reset.","status":"published","published":"2026-10-07T23:27:12Z","modified":"2026-10-10T02:50:49Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T17:27:24.157251Z"}],"ghsa":[{"id":"GHSA-gw8m-rqgv-6j3j","title":"The LatePoint - Appointment Booking \u0026 Reservation plugin for WordPress is vulnerable to Insecure...","description":"The LatePoint - Appointment Booking \u0026 Reservation plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 5.6.9. This is due to the process_step_customer() function using is_user_logged_in() as the sole gate before merging POSTed customer data into an existing LatePoint customer, without any ownership checks. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify the personal information (first name, last name, email, phone, notes) of arbitrary LatePoint customers, and, when the contact_merge setting is 'phone', to overwrite the victim's email address and take over the account via a password reset.","status":"published","published":"2026-10-08T00:30:59Z","modified":"2026-10-08T00:31:10Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-639"],"updated_at":"2026-11-02T15:12:55.932488Z"}],"nvd":[{"id":"CVE-2026-17538","description":"The LatePoint - Appointment Booking \u0026 Reservation plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 5.6.9. This is due to the process_step_customer() function using is_user_logged_in() as the sole gate before merging POSTed customer data into an existing LatePoint customer, without any ownership checks. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify the personal information (first name, last name, email, phone, notes) of arbitrary LatePoint customers, and, when the contact_merge setting is 'phone', to overwrite the victim's email address and take over the account via a password reset.","status":"published","published":"2026-10-08T00:16:35.153Z","modified":"2026-10-10T03:17:07.183Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-639"],"updated_at":"2026-11-02T14:12:55.142936Z"}]}}