CVE-2026-11866

Name of the Vulnerable Software and Affected Versions LatePoint versions prior to 5.6.3

Description Cross-Site Request Forgery (CSRF) occurs when a web application fails to verify that a request was intentionally initiated by the user. The plugin does not validate a CSRF nonce on several state-changing actions handled by its central request dispatcher. This allows attackers to perform privileged actions via a forged request if a logged-in administrator is tricked into clicking a link. Potential impacts include overwriting the booking-form configuration or disconnecting the connected payment gateway.

Recommendations Update to version 5.6.3 or later.