CVE-2026-105257
LatePoint < 5.7.5 - Agent+ Customer PII Disclosure via IDOR
- State
- Published
- Severity
- 2.7 Low
- Published
- Oct 21, 2026
- Updated
- Oct 21, 2026
- Reserved
- Oct 4, 2026
Description
The Appointment Booking Plugin WordPress plugin before 5.7.5 does not verify that an authenticated agent-level user is assigned to a customer before returning or searching that customer's record, allowing any agent to read and enumerate the personal information of every customer on the site, including those managed by other agents.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 2.7 Low | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N | CISA-ADP |
Weaknesses
- CWE-639 Authorization Bypass Through User-Controlled Key
Affected Products
| Product | Versions |
|---|---|
Appointment Booking PluginUnknown |
|
References
- https://wpscan.com/vulnerability/10a8f09f-8282-456d-ad07-7e594e70a371/exploitvdb-entrytechnical-description
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.