CVE-2026-96662

Name of the Vulnerable Software and Affected Versions Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress versions prior to 5.7.3

Description An unauthenticated SQL Injection exists due to insufficient escaping of user-supplied input and lack of proper preparation of the SQL query. This allows attackers to append additional SQL queries to existing ones to extract sensitive information from the database. The issue is triggered via the booking[service id] parameter.

Recommendations Update the plugin to a version newer than 5.7.2. Avoid using the booking[service id] parameter until the update is applied.