Live › vulnerability › CVE-2026-111602
Go to dashboardThe LatePoint booking plugin for WordPress lets an unauthenticated visitor enumerate customer UUID prefixes through the steps__load_step AJAX endpoint. An attacker can then read first name, last name, email, phone and notes for every customer record.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running LatePoint up to and including 5.7.4 with the 'Field used for authentication' setting set to 'Disable ability to login' (guest checkout mode) are exposed. Sites on other authentication settings, or on a patched version, are not affected by this flaw.
No product ranges from the sources yet.
wp plugin get latepoint --field=version, and compare with 5.7.4.5.7.4, the first release the sources do not list as affected; confirm the exact fixed version in the vendor advisory.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.7.4 via the 'params (customer[uuid])' parameter. This makes it possible for unauthenticated attackers to extract the first name, last name, email address, phone number, and notes of every customer record in the database by enumerating uuid prefixes via the unauthenticated steps__load_step AJAX endpoint. This vulnerability is only exploitable when the LatePoint plugin is configured with the 'Field used for authentication' setting set to 'Disable ability to login' (guest checkout mode).
This page as .md · .json · in your agent: get_signal("CVE-2026-111602")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.