CVE-2026-17538 in LatePoint Plugin
Summary
by MITRE • 10/08/2026
The LatePoint - Appointment Booking & Reservation plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 5.6.9. This is due to the process_step_customer() function using is_user_logged_in() as the sole gate before merging POSTed customer data into an existing LatePoint customer, without any ownership checks. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify the personal information (first name, last name, email, phone, notes) of arbitrary LatePoint customers, and, when the contact_merge setting is 'phone', to overwrite the victim's email address and take over the account via a password reset.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/08/2026
The vulnerability identified in LatePoint versions up to 5.6.9 represents a critical failure in access control mechanisms within the WordPress plugin ecosystem. Specifically, this flaw manifests as an Insecure Direct Object Reference (IDOR), categorized under CWE-639. The root cause lies in the implementation of the process_step_customer() function, which serves as the endpoint for updating customer information during appointment booking or reservation workflows. While the application correctly verifies that a user is authenticated by checking if they are logged in via the is_user_logged_in() method, it fails to validate whether the authenticated user has authorization to modify the specific resource being targeted. This absence of object-level permission checks allows any authenticated actor with Subscriber-level access or higher to interact directly with customer records belonging to other users.
From a technical perspective, the exploitation vector involves sending crafted HTTP POST requests that include parameters for personal data such as first name, last name, email address, phone number, and internal notes. Because the backend logic merges this incoming data into an existing LatePoint customer record identified by an ID provided in the request or session context without verifying ownership, attackers can arbitrarily select victim IDs. This capability enables malicious actors to alter the personal information of any registered user on the platform. The impact extends beyond simple data modification; it facilitates account takeover scenarios when specific configuration settings are active. If the contact_merge setting is configured to prioritize phone numbers, an attacker can overwrite a victim's email address with one they control. Subsequently, by initiating a password reset for that compromised email address, the attacker gains full administrative or user-level access to the victim’s LatePoint account and associated appointment history.
The operational impact of this vulnerability is severe, affecting both data integrity and confidentiality within the application. For end-users, it results in unauthorized modification of personal details, which can lead to privacy violations and potential harassment if sensitive notes are altered. More critically, the ability to hijack accounts through email overwriting compromises the security posture of the entire user base. Attackers with Subscriber-level access, a relatively low privilege level often granted to casual users or registered members, can escalate their influence significantly by targeting high-value accounts such as administrators or frequent customers. This undermines trust in the platform and exposes organizations using LatePoint for business operations to significant reputational and financial risks due to compromised customer data and unauthorized account activities.
This vulnerability aligns with several entries in the MITRE ATT&CK framework, particularly those related to Privilege Escalation and Account Manipulation. The initial access is achieved through valid credentials, but the exploitation of IDOR allows for lateral movement or privilege escalation by compromising other accounts. Furthermore, the modification of user attributes falls under T1098, specifically SSH Authorized Keys Modification if applied broadly, but more accurately maps to User Account Modification techniques where an adversary alters account properties to maintain persistence or facilitate further attacks. The lack of proper authorization checks is a classic example of CWE-269, Improper Privilege Management, compounded by the direct object reference flaw in CWE-639.
To mitigate this vulnerability, immediate action should be taken by updating LatePoint to version 5.7.0 or later, where these access control issues have been addressed. In environments where an update is not immediately feasible, administrators can implement compensating controls such as restricting the Subscriber role’s ability to execute specific API endpoints if possible through additional security plugins or web application firewall rules that inspect request payloads for unauthorized object references. Additionally, enforcing strict ownership validation on all server-side functions handling user data updates is essential. Developers should ensure that every operation involving sensitive personal information verifies that the requesting user ID matches the owner of the target resource before processing any modifications. Regular code audits focusing on authorization logic and adherence to OWASP guidelines for access control are recommended to prevent similar flaws in future development cycles.