Read the docs
TI-2026-78596 Aliases CVE-2026-105257GHSA-hqp5-p5mj-5p69

Missing ownership check in LatePoint exposes customer personal data to agents

Priority LOW 13CWE-639Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-639.

Summary

The LatePoint Appointment Booking Plugin for WordPress before 5.7.5 does not check that an authenticated agent is assigned to a customer before returning or searching that customer's record. An agent-level user with high privileges can read and enumerate the personal information of customers managed by other agents, tracked as CWE-639.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

The Appointment Booking Plugin WordPress plugin before 5.7.5 does not verify that an authenticated agent-level user is assigned to a customer before returning or searching that customer's record, allowing any agent to read and enumerate the personal information of every customer on the site, including those managed by other agents.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00289 21st percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix Fixed Appointment Booking Plugin (Unknown): 5.7.5

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
UnknownAppointment Booking Pluginbefore 5.7.55.7.5Patch availableCNA
  • Appointment Booking Plugin VendorUnknown Affected before 5.7.5 Fixed in 5.7.5 Patch available CNA

Remediation

Update the Appointment Booking Plugin to version 5.7.5 or later, which fixes this issue. The sources list no advisory identifier for this fix.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA Appointment Booking Plugin (Unknown) Fixed in 5.7.5

Timeline

  1. 2026-10-21 Threatist record created from CVE-2026-105257
  2. 2026-10-21 Alias added: GHSA-hqp5-p5mj-5p69

References

Exploit 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences