CVE-2026-105256 in LatePoint Plugin
Summary
by MITRE • 10/22/2026
The LatePoint WordPress plugin before 5.7.5 does not validate the client-supplied value that determines how much is charged for a booking against the amounts the service and site actually allow, allowing an unauthenticated visitor to make the amount due resolve to zero and obtain a confirmed appointment and a recorded order without completing any payment.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/22/2026
The vulnerability identified in LatePoint WordPress plugin versions prior to 5.7.5 represents a critical business logic flaw rooted in insufficient input validation on the server side. Specifically, the application fails to verify that the monetary amount submitted by the client during the booking process aligns with the predefined pricing structures established for specific services and site configurations. This lack of authoritative price verification allows an unauthenticated attacker to manipulate the transaction parameters, effectively bypassing the payment gateway integration entirely. By altering or omitting the charge value in the request payload, the system accepts a zero-dollar amount as valid, leading to the generation of confirmed appointments and recorded orders without any actual financial exchange taking place.
From a technical perspective, this flaw is classified under CWE-20 Improper Input Validation because the application does not adequately sanitize or validate user-supplied data before processing it for critical business operations. Furthermore, it aligns with CWE-841 Improvement of Incorrect Permissions which relates to the bypassing of access controls and payment requirements that are intended to restrict certain actions to paying users only. The core issue lies in the server-side logic trusting client-provided values rather than calculating or retrieving the expected price from a secure database source during the checkout phase. This design pattern creates an opportunity for abuse where the integrity of the transaction is compromised by external manipulation, undermining the fundamental trust model required for e-commerce and service booking platforms.
The operational impact of this vulnerability is significant for both business owners and legitimate customers. For site administrators, it results in direct financial loss as services are rendered without compensation, potentially leading to resource depletion if exploited at scale through automated scripts. Additionally, the integrity of appointment scheduling systems can be compromised, causing logistical disruptions due to phantom bookings that occupy time slots but generate no revenue. Legitimate users may also face indirect consequences such as degraded service quality or increased costs passed down from lost revenues. The ability for unauthenticated visitors to complete transactions without payment erodes customer trust and exposes the organization to potential legal liabilities regarding contract fulfillment and fraud prevention standards.
To mitigate this vulnerability, immediate action is required by updating the LatePoint plugin to version 5.7.5 or later where these validation checks have been implemented. In the interim, administrators should consider implementing server-side price verification logic that retrieves the expected cost from a secure database record based on service ID and date rather than relying on client-supplied values. Integrating additional fraud detection mechanisms such as CAPTCHA for booking submissions can help mitigate automated exploitation attempts. Furthermore, reviewing web application firewall rules to detect anomalous patterns in checkout requests where payment amounts are consistently zero or significantly below expected thresholds may provide an extra layer of defense against this specific type of business logic abuse until the patch is applied.