Matan Bachar

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 5.7.1 via the OsPaypalConnectController::create order for transaction() action registered as a public (unauthenticated) route through wp ajax nopriv latepoint route call. The handler loads an OsInvoiceModel by a sequential integer 'invoice id' with no access-key/UUID or ownership check (the sibling Stripe and Razorpay handlers require a 128-bit access-key UUID via OsInvoicesHelper::get invoice by key), and then calls OsTransactionIntentHelper::create or update transaction intent() which persists a transaction intent tied to the target invoice's customer id, order id and charge amount and regenerates its intent key before the PayPal-configured guard is reached. This makes it possible for unauthenticated attackers to enumerate invoices belonging to arbitrary customers, create unauthorized transaction-intent rows linked to another customer's data, and overwrite the intent key of any in-flight NEW-status transaction intent — invalidating the intent key that legitimate Stripe/Razorpay flows are waiting on and breaking payment webhooks for those customers.