CVE-2026-17538

Published 8 October 2026 · tracked since 8 October 2026

Description

The LatePoint - Appointment Booking & Reservation plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 5.6.9. This is due to the process_step_customer() function using is_user_logged_in() as the sole gate before merging POSTed customer data into an

References

• NVD — National Vulnerability Database
• CVE.org record (MITRE)
• CISA Known Exploited Vulnerabilities catalog

Latest tracked vulnerabilities

• CVE-2026-107573 HIGH 7.8
• CVE-2026-107275 MEDIUM 6.8
• CVE-2026-93509 MEDIUM 6.5
• CVE-2026-104660 HIGH 7.8
• CVE-2026-104671 MEDIUM 5.3
• CVE-2026-105190 MEDIUM 5.3
• CVE-2026-103649 HIGH 7.5
• CVE-2026-103010 HIGH 7.8
• CVE-2026-103011 MEDIUM 6.5
• CVE-2026-103517 MEDIUM 5.3

→ Open the live CVE board · all tools