---
id: "CVE-2026-111602"
kind: "vulnerability"
aliases: ["CVE-2026-111602"]
title: "LatePoint WordPress plugin: unauthenticated customer data exposure via AJAX endpoint"
severity: "low"
cvss: 3.7
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["booking", "latepoint", "package", "self-hosted", "wordpress", "wordpress-plugin"]
not_affected_if: ["default-config", "patched-version"]
published_at: "2026-10-17T03:16:28+00:00"
first_seen_at: "2026-10-23T21:57:14+00:00"
updated_at: "2026-10-25T04:45:19+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111602", "first_seen_at": "2026-10-23T21:57:14+00:00"}]
---

# LatePoint WordPress plugin: unauthenticated customer data exposure via AJAX endpoint

The LatePoint booking plugin for WordPress lets an unauthenticated visitor enumerate customer UUID prefixes through the steps__load_step AJAX endpoint. An attacker can then read first name, last name, email, phone and notes for every customer record.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed LatePoint version in the WordPress plugins screen or `wp plugin get latepoint --field=version`, and compare with `5.7.4`.
- In LatePoint settings, check whether 'Field used for authentication' is set to 'Disable ability to login' (guest checkout mode).

## Fix

- Update LatePoint to a version newer than `5.7.4`, the first release the sources do not list as affected; confirm the exact fixed version in the vendor advisory.
- If an update is not possible, change 'Field used for authentication' away from 'Disable ability to login' until the plugin is patched.

## Timeline

- 2026-10-23T21:57:14+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111602

## From the sources

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.7.4 via the 'params (customer[uuid])' parameter. This makes it possible for unauthenticated attackers to extract the first name, last name, email address, phone number, and notes of every customer record in the database by enumerating uuid prefixes via the unauthenticated steps__load_step AJAX endpoint. This vulnerability is only exploitable when the LatePoint plugin is configured with the 'Field used for authentication' setting set to 'Disable ability to login' (guest checkout mode).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_