LatePoint Plugin up to 5.6.1 on WordPress Phone Number is_customer_auth_disabled authorization

Summaryinfo

A vulnerability has been found in LatePoint Plugin up to 5.6.1 on WordPress and classified as critical. The affected element is the function is_customer_auth_disabled of the component Phone Number Handler. The manipulation leads to authorization. This vulnerability is referenced as CVE-2026-11398. Remote exploitation of the attack is possible. No exploit is available. The affected component should be upgraded.

Detailsinfo

A vulnerability, which was classified as critical, has been found in LatePoint Plugin up to 5.6.1 on WordPress. This issue affects the function is_customer_auth_disabled of the component Phone Number Handler. The manipulation with an unknown input leads to a authorization vulnerability. Using CWE to declare the problem leads to CWE-862. The product does not perform an authorization check when an actor attempts to access a resource or perform an action. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.6.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to modify the personally identifiable information (first name, last name, phone number, and notes) of any existing customer record, including those linked to administrator accounts, by submitting the booking form with a known customer's email address. Exploitation requires the plugin to be configured with guest bookings enabled (is_customer_auth_disabled() returning true), which is necessary for the vulnerable unauthenticated code path in process_step_customer() to be reached.

The weakness was published by hhhai. The advisory is shared at wordfence.com. The identification of this vulnerability is CVE-2026-11398 since 06/05/2026. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Technical details are known, but no exploit is available.

Upgrading to version 5.3.2 eliminates this vulnerability.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• WordPress Plugin

Name

• LatePoint Plugin

Version

• 5.6.0
• 5.6.1

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion