{"id":"CVE-2026-111602","kind":"vulnerability","aliases":["CVE-2026-111602"],"related":[],"title":"LatePoint WordPress plugin: unauthenticated customer data exposure via AJAX endpoint","description":"The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.7.4 via the 'params (customer[uuid])' parameter. This makes it possible for unauthenticated attackers to extract the first name, last name, email address, phone number, and notes of every customer record in the database by enumerating uuid prefixes via the unauthenticated steps__load_step AJAX endpoint. This vulnerability is only exploitable when the LatePoint plugin is configured with the 'Field used for authentication' setting set to 'Disable ability to login' (guest checkout mode).","summary":"The LatePoint booking plugin for WordPress lets an unauthenticated visitor enumerate customer UUID prefixes through the steps__load_step AJAX endpoint. An attacker can then read first name, last name, email, phone and notes for every customer record.","severity":"low","cvss":3.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["booking","latepoint","package","self-hosted","wordpress","wordpress-plugin"],"not_affected_if":["default-config","patched-version"],"how_to_check":"- Check the installed LatePoint version in the WordPress plugins screen or `wp plugin get latepoint --field=version`, and compare with `5.7.4`.\n- In LatePoint settings, check whether 'Field used for authentication' is set to 'Disable ability to login' (guest checkout mode).","fix":"- Update LatePoint to a version newer than `5.7.4`, the first release the sources do not list as affected; confirm the exact fixed version in the vendor advisory.\n- If an update is not possible, change 'Field used for authentication' away from 'Disable ability to login' until the plugin is patched.","status":"open","published_at":"2026-10-17T03:16:28+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","triaged_at":"2026-10-25T04:45:19+00:00","updated_at":"2026-10-25T04:45:19+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-25T04:45:19Z","model":"claude-haiku-5-5","output":{"fix":"- Update LatePoint to a version newer than `5.7.4`, the first release the sources do not list as affected; confirm the exact fixed version in the vendor advisory.\n- If an update is not possible, change 'Field used for authentication' away from 'Disable ability to login' until the plugin is patched.","reach":"internet","title":"LatePoint WordPress plugin: unauthenticated customer data exposure via AJAX endpoint","impact":"medium","summary":"The LatePoint booking plugin for WordPress lets an unauthenticated visitor enumerate customer UUID prefixes through the steps__load_step AJAX endpoint. An attacker can then read first name, last name, email, phone and notes for every customer record.","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-plugin","latepoint","booking","self-hosted"],"confidence":0.8,"needs_auth":"no","worst_case":"Unauthenticated attackers read names, emails, phones and notes of all customers.","analyst_note":"","how_to_check":"- Check the installed LatePoint version in the WordPress plugins screen or `wp plugin get latepoint --field=version`, and compare with `5.7.4`.\n- In LatePoint settings, check whether 'Field used for authentication' is set to 'Disable ability to login' (guest checkout mode).","needs_analyst":false,"not_affected_if":["default-config","patched-version"],"who_is_affected":"Sites running LatePoint up to and including 5.7.4 with the 'Field used for authentication' setting set to 'Disable ability to login' (guest checkout mode) are exposed. Sites on other authentication settings, or on a patched version, are not affected by this flaw.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000657,"input_tokens":3462,"output_tokens":622,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-111602':13A,16A '-2026':12A,15A '5.7.4':90C 'abil':157C 'address':112C 'ajax':9A,46B,134C 'appoint':66C 'attack':49B,103C 'authent':152C 'book':17B,29B,67C 'calendar':70C 'checkout':161C 'configur':146C 'custom':5A,38B,63B,94C,119C 'cve':11A,14A 'data':6A 'databas':123C 'disabl':156C 'email':57B,111C 'endpoint':10A,47B,135C 'enumer':37B,125C 'everi':62B,118C 'exploit':140C 'exposur':7A,82C 'extract':105C 'field':149C 'first':53B,107C 'guest':160C 'host':22B 'includ':89C 'inform':81C 'last':55B,109C 'latepoint':1A,18B,28B,69C,143C 'let':33B 'load':44B,132C 'login':159C 'make':98C 'mode':162C 'name':54B,56B,108C,110C 'note':60B,116C 'number':114C 'packag':19B 'param':93C 'paramet':96C 'phone':58B,113C 'plugin':3A,26B,30B,68C,74C,144C 'possibl':100C 'prefix':40B,127C 'read':52B 'record':64B,120C 'schedul':71C 'self':21B 'self-host':20B 'sensit':80C 'set':153C,154C 'step':43B,45B,131C,133C 'unauthent':4A,35B,102C,130C 'use':150C 'uuid':39B,95C,126C 'version':85C 'via':8A,91C,128C 'visitor':36B 'vulner':78C,137C 'wordpress':2A,23B,25B,32B,73C,76C 'wordpress-plugin':24B","nicknames":[],"mitigations":[],"who_affected":"Sites running LatePoint up to and including 5.7.4 with the 'Field used for authentication' setting set to 'Disable ability to login' (guest checkout mode) are exposed. Sites on other authentication settings, or on a patched version, are not affected by this flaw.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-17T03:16:28+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111602","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111602","severity":null,"published_at":"2026-10-17T03:16:28+00:00","modified_at":"2026-10-19T15:16:45+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}