PT-2026-33403 · Latepoint · Latepoint

Darkestmode · Published 2026-04-17 · Updated 2026-04-17 · CVE-2026-5234

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions LatePoint versions prior to 5.3.3

Description An Insecure Direct Object Reference exists because the OsStripeConnectController::create payment intent for transaction() function is registered as a public action requiring no authentication. The system loads invoices using sequential integer invoice id values without verifying ownership or requiring an access key. This allows unauthenticated attackers to enumerate valid invoice IDs through error messages and create unauthorized transaction intent records containing sensitive financial data, including invoice id, order id, customer id, and charge amount. Additionally, on sites using Stripe Connect, the response leaks payment intent client secret tokens, transaction intent key values, and payment amounts for any invoice.

Recommendations Update to a version newer than 5.3.2.

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2026-5234

Affected Products

Latepoint

References · 13

• https://nvd.nist.gov/vuln/detail/CVE-2026-5234 · Security Note
• https://plugins.trac.wordpress.org/browser/latepoint/trunk/lib/controllers/stripe_connect_controller.php#L31 · Note
• https://plugins.trac.wordpress.org/browser/latepoint/tags/5.2.9/lib/controllers/stripe_connect_controller.php#L20 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/afec4c8c-a18d-4907-8879-2412f8a1abed?source=cve · Note
• https://plugins.trac.wordpress.org/browser/latepoint/tags/5.2.9/lib/controllers/stripe_connect_controller.php#L33 · Note
• https://twitter.com/CVEnew/status/2045102612765081839 · Twitter Post
• https://plugins.trac.wordpress.org/browser/latepoint/trunk/lib/controllers/stripe_connect_controller.php#L50 · Note
• https://plugins.trac.wordpress.org/browser/latepoint/tags/5.2.9/lib/controllers/stripe_connect_controller.php#L50 · Note
• https://plugins.trac.wordpress.org/browser/latepoint/trunk/lib/controllers/stripe_connect_controller.php#L33 · Note
• https://twitter.com/VulmonFeeds/status/2045083952860328150 · Twitter Post
• https://plugins.trac.wordpress.org/changeset/3505127/latepoint/trunk/lib/controllers/stripe_connect_controller.php · Note
• https://plugins.trac.wordpress.org/browser/latepoint/tags/5.2.9/lib/controllers/stripe_connect_controller.php#L31 · Note
• https://plugins.trac.wordpress.org/browser/latepoint/trunk/lib/controllers/stripe_connect_controller.php#L20 · Note