CVE-2026-11398

Name of the Vulnerable Software and Affected Versions LatePoint – Calendar Booking Plugin for Appointments and Events versions prior to 5.6.2

Description An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. Unauthenticated attackers can modify personally identifiable information, including first name, last name, phone number, and notes, of any existing customer record, including those associated with administrator accounts. This is achieved by submitting the booking form using a known customer email address. This issue is exploitable when the plugin is configured to allow guest bookings, which allows the execution of the vulnerable unauthenticated code path in the process step customer() function.

Recommendations Update to a version newer than 5.6.1. As a temporary mitigation, disable guest bookings to prevent the process step customer() function from being accessed by unauthenticated users.