Live › vulnerability › CVE-2026-105256
Go to dashboardThe LatePoint WordPress booking plugin before 5.7.5 trusts a client-supplied price value and does not check it against the service price. An unauthenticated visitor can set the amount due to zero and get a confirmed appointment and order without paying.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the LatePoint WordPress plugin before 5.7.5 that take bookings with payment through it are exposed. Sites without LatePoint, or on 5.7.5 or later, can skip this.
No product ranges from the sources yet.
wp-content/plugins/latepoint/latepoint.php5.7.5 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The LatePoint WordPress plugin before 5.7.5 does not validate the client-supplied value that determines how much is charged for a booking against the amounts the service and site actually allow, allowing an unauthenticated visitor to make the amount due resolve to zero and obtain a confirmed appointment and a recorded order without completing any payment.
This page as .md · .json · in your agent: get_signal("CVE-2026-105256")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.