Description
The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.7.3 via the 'params[customer][first_name]' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract privileged booking data including the administrator-only admin_notes field, assigned agent internal contact details, transaction tokens, and payment request URLs delivered via rendered notification emails. A LatePoint customer can exploit this by storing a template placeholder such as {{customer_admin_notes}} in their own first_name field via the customer_cabinet__update route, then triggering the password-reset email flow to receive the expanded value in the resulting notification.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
latepoint Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress
Default version status: unaffected
0 to ≤ 5.7.3affected
References
- https://www.wordfence.com/threat-intel/vulnerabilities/id/4494960c-66ed-47d9-b3fc-5a5ec5a07b1f?source=cve ↗
- https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.3/lib/helpers/replacer_helper.php#L278 ↗
- https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.3/lib/helpers/replacer_helper.php#L614 ↗
- https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.3/lib/controllers/customer_cabinet_controller.php#L321 ↗
- https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.3/lib/models/customer_model.php#L388 ↗
- https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.3/lib/mailers/customer_mailer.php#L33 ↗
- https://plugins.trac.wordpress.org/changeset?reponame=&old=3728691%40latepoint&new=3728691%40latepoint ↗