PT-2026-7813 · WordPress · Latepoint – Calendar Booking Plugin For Appointments/Events

Chiao-Lin Yu · Publicado 2026-02-12 · Atualizado 2026-02-12 · CVE-2026-1537

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions LatePoint – Calendar Booking Plugin for Appointments and Events versions prior to 5.2.7

Description The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress has a flaw that allows unauthorized access to data. This is due to a missing capability check within the load step() function. An unauthenticated attacker can view booking information, including customer names, email addresses, phone numbers, appointment times, and service details.

Recommendations Update to version 5.2.7 or later.

Correção

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2026-1537

Produtos afetados

Latepoint – Calendar Booking Plugin For Appointments/Events

Referências · 8

• https://wordfence.com/threat-intel/vulnerabilities/id/c18ad885-52a8-467b-83f2-aeb0c8be8be0?source=cve · Nota
• https://plugins.trac.wordpress.org/browser/latepoint/tags/5.2.5/lib/models/model.php#L562 · Nota
• https://t.me/CVEtracker/44500 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2026-1537 · Nota de Segurança
• https://t.me/cveNotify/151802 · Publicação no Telegram
• https://plugins.trac.wordpress.org/browser/latepoint/tags/5.2.5/lib/helpers/steps_helper.php#L231 · Nota
• https://twitter.com/VulmonFeeds/status/2021938702360928463 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2021799449136443693 · Publicação no Twitter