CVE-2026-9719

Name of the Vulnerable Software and Affected Versions LatePoint – Calendar Booking Plugin for Appointments and Events versions prior to 5.6.1

Description The plugin is affected by Cross-Site Request Forgery, a flaw where an attacker tricks a victim into performing actions they did not intend to. This occurs due to missing or incorrect nonce validation in the change status() function. Unauthenticated attackers can exploit this to change the status of arbitrary invoices, such as marking unpaid invoices as paid, by inducing a site administrator to click a malicious link.

Recommendations Update the plugin to a version later than 5.6.0. As a temporary workaround, restrict administrator access to the change status() function until the update is applied.