WordPress plugin
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress security & vulnerabilities
Unpatched vulnerability in the latest version
At least one vulnerability affects the latest version and no fix has been released. Deactivate the plugin or restrict access to the affected feature until the vendor ships a patch.
- Critical7
- High16
- Medium35
- Low1
All Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress vulnerabilities
- Critical9.1Unauthenticated Authentication Bypass via Account Takeover via 'IS NOT NULL' Sentinel in 'password_reset_token' Parameter
≤5.7.6Update to 5.7.7
- Critical9.1Unauthenticated Authentication Bypass via Race Condition on OTP Attempts Counter
≤5.7.4Update to 5.7.5
- High7.4Unauthenticated Authentication Bypass to Customer Account Takeover via Insufficient Verification in create_wp_user_for_customer() username_exists Fallback
≤5.7.2Update to 5.7.3
- High7.5Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'booking[id]' and 'cart[id]' Parameters
≤5.7.3Update to 5.7.4
- High7.5Unauthenticated SQL Injection via 'booking[service_id]' Parameter
≤5.7.2Update to 5.7.3
- High8.8Authenticated (Custom+) Privilege Escalation to 'settings[default_wp_role_for_customer]' Parameter
≤5.7.3Update to 5.7.4
- Critical9.1Unauthenticated Arbitrary Shortcode Execution via First/Last Name Field
≤5.7.0Update to 5.7.1
- High7.5Unauthenticated SQL Injection
≤5.6.3Update to 5.6.4
- High7.5Calendar Booking Plugin for Appointments and Events <= 5.4.0 - Unauthenticated Stripe PaymentIntent Amount-Binding Bypass
≤5.4.0Update to 5.4.1
- High8.8Authenticated (Custom+) Privilege Escalation to Administrator via 'order[customer_id]' Parameter
≤5.6.3Update to 5.6.4
- High7.5Authenticated (Agent+) Privilege Escalation to Administrator via IDOR in OsOrdersController::create_or_update + Unauthenticated Customer-Cabinet Password Reset
≤5.5.1Update to 5.5.2
- High8.8Authenticated (Contributor+) Privilege Escalation
≤5.5.1Update to 5.5.2
- High7.2Unauthenticated Stored Cross-Site Scripting
≤5.5.0Update to 5.5.1
- High7.2Unauthenticated Stored Cross-Site Scripting via 'booking_form_page_url' Parameter
≤5.5.0Update to 5.5.1
- High8.8Authenticated (Agent+) Privilege Escalation to Administrator via 'connect-customer-to-wp-user' Ability
≤5.4.1Update to 5.4.2
- High8.8Authenticated (Agent+) Privilege Escalation
≤5.2.7Update to 5.2.8
- High7.2Unauthenticated Stored Cross-Site Scripting
≤5.2.5Update to 5.2.6
- High8.2Unauthenticated Authentication Bypass via load_step Function
≤5.1.94Update to 5.2.0
- High8.8Cross-Site Request Forgery to Account Takeover via change_password() Function
≤5.1.94Update to 5.2.0
- Critical9.8Unauthenticated Local File Inclusion
≤5.1.93Update to 5.1.94
- Critical9.8Authentication Bypass
≤5.0.12Update to 5.0.13
- Critical9.8Unauthenticated Arbitrary User Password Change via SQL Injection
≤5.0.11Update to 5.0.12
- Critical9.1Missing Authorization and Sensitive Information Exposure via IDOR
≤4.9.9Update to 4.9.9.1
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress: common questions
Does Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress have known vulnerabilities?
Yes. VulnCrest Radar lists 59 known vulnerabilities in Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress: 7 critical, 16 high, 35 medium, 1 low. At least one is not fixed in the latest version.
How do I check which version of Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress vulnerability?
CVE-2026-118066, published Nov 6, 2026: Appointment Booking Plugin <= 5.7.6 - Unauthenticated Authentication Bypass via Account Takeover via 'IS NOT NULL' Sentinel in 'password_reset_token' Parameter. Severity: Critical (CVSS 9.1).
Is any Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress vulnerability listed in CISA KEV?
No. None of the known Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress vulnerabilities is currently listed in the CISA KEV catalog.