CVE-2026-91050

Name of the Vulnerable Software and Affected Versions LatePoint | Calendar & Scheduling for WordPress versions prior to 5.7.3

Description An Insecure Direct Object Reference (IDOR) and missing authorization issue exists in the LatePoint plugin. The publicly accessible endpoints 'steps start' and 'steps load step' accept a params[presets][order item id] value that is integrated into the booking object without verifying if the order item belongs to the current customer, is a bundle item, is paid, or has remaining capacity. The is bundle scheduling() function fails to properly validate the bundle, performing only a basic truthiness check on the order item id. This allows unauthenticated attackers to create approved appointments using other customers' order items and access sensitive information, including customer names, email addresses, and order codes, via the booking confirmation.

Recommendations Update to a version newer than 5.7.2. Restrict access to the 'steps start' and 'steps load step' endpoints to minimize the risk of exploitation.