CVE-2026-103380 in Appointment Booking Plugin
Summary
by MITRE • 10/14/2026
The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.7.3 via the 'params[customer][first_name]' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract privileged booking data including the administrator-only admin_notes field, assigned agent internal contact details, transaction tokens, and payment request URLs delivered via rendered notification emails. A LatePoint customer can exploit this by storing a template placeholder such as {{customer_admin_notes}} in their own first_name field via the customer_cabinet__update route, then triggering the password-reset email flow to receive the expanded value in the resulting notification.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/14/2026
The vulnerability identified within the Appointment Booking Plugin LatePoint for WordPress affects all versions up to and including 5.7.3. This security flaw is classified as a sensitive information exposure issue, specifically linked to CWE-200 which covers Exposure of Sensitive Information to an Unauthorized Actor. The core technical defect resides in how the plugin handles user input during account updates and subsequent email notification generation. Specifically, the parameter params[customer][first_name] fails to properly sanitize or restrict data before it is processed for inclusion in system-generated emails. This lack of adequate validation allows a malicious actor to inject content that persists beyond its intended context, leading to the leakage of privileged administrative data through standard communication channels like password reset notifications.
The operational impact of this vulnerability is significant because it enables authenticated attackers with subscriber-level access or higher to extract sensitive booking information that should remain confidential. By exploiting the customer_cabinet__update route, an attacker can store a template placeholder such as {{customer_admin_notes}} directly within their own first_name field in the user profile. When the system subsequently triggers a password-reset email flow for this account, it processes these stored values without proper isolation or filtering. As a result, the rendered notification emails contain expanded administrative data that was never intended to be visible to non-administrative users. This includes administrator-only fields like admin_notes, internal contact details of assigned agents, transaction tokens, and payment request URLs. Such exposure compromises both privacy and security by revealing operational workflows and potentially facilitating further attacks using valid transaction links or agent contact information.
From a threat intelligence perspective, this vulnerability aligns with ATT&CK technique T1005 which refers to Data from Local System Retrieval, as the attacker is extracting data stored within the application's database that they are not authorized to view directly via standard interfaces. The exploitation path relies on social engineering or automated scripts to trigger password reset emails, making it a low-complexity attack vector for any user with at least subscriber privileges. This highlights a critical failure in implementing proper access controls and output encoding mechanisms within the plugin's email templating engine.
To mitigate this vulnerability, immediate action is required by updating the LatePoint plugin to version 5.7.4 or later where these input validation issues have been addressed. Administrators should also review user roles and ensure that only necessary privileges are granted to subscribers, adhering to the principle of least privilege. Additionally, implementing strict output encoding for all dynamic content inserted into email templates can prevent template injection attacks from leaking sensitive data. Security teams should monitor logs for unusual patterns in password reset requests associated with accounts containing suspicious characters or placeholders in personal information fields. Regular security audits and penetration testing focusing on user input handling and notification generation processes are recommended to identify similar flaws before they can be exploited by malicious actors seeking unauthorized access to internal business data.