PT-2025-21146 · WordPress · Latepoint – Calendar Booking Plugin For Appointments/Events

Martin Martin · Published 2025-05-14 · Updated 2025-05-14 · CVE-2025-3769

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions: LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress versions up to, and including, 5.1.92

Description: The issue allows unauthenticated attackers to retrieve appointment details, such as customer names and email addresses, due to missing validation on a user-controlled key in the 'view booking summary in lightbox' endpoint. This enables attackers to access sensitive information without proper authorization.

Recommendations: For versions up to, and including, 5.1.92, consider disabling the view booking summary in lightbox feature until a patch is available to prevent unauthorized access to appointment details. Restrict access to sensitive information by implementing proper validation on user-controlled keys to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2025-3769

Affected Products

Latepoint – Calendar Booking Plugin For Appointments/Events

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-3769 · Security Note
• https://twitter.com/CVEnew/status/1922695644436889765 · Twitter Post
• https://plugins.trac.wordpress.org/changeset/3291162 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/7e9acd26-c341-4ece-bcf1-102f953a4b4f?source=cve · Note
• https://t.me/cvenotify/122104 · Telegram Post
• https://plugins.trac.wordpress.org/browser/latepoint/trunk/lib/controllers/customer_cabinet_controller.php · Note
• https://t.me/cvetracker/23824 · Telegram Post