CVE-2026-17538

Name of the Vulnerable Software and Affected Versions LatePoint - Appointment Booking & Reservation plugin for WordPress versions prior to 5.7.0

Description An Insecure Direct Object Reference exists because the process step customer() function relies solely on is user logged in() to validate requests before merging POSTed customer data into an existing record, lacking necessary ownership checks. Authenticated users with Subscriber-level access or higher can modify the personal information of arbitrary customers, including first name, last name, email, phone, and notes. Additionally, if the contact merge setting is configured as 'phone', an attacker can overwrite a victim's email address to facilitate account takeover through a password reset.

Recommendations Update the plugin to a version later than 5.6.9.