What’s Vulnerable › Vulnerabilities
CVE-2026-15250: LatePoint < 5.6.8 - Unauthenticated Booking Object Mass Assignment via Public Booking Funnel
- Severity: medium (CVSS 5.3 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-07-30 · updated 2026-07-30
- Weakness: CWE-284
Description
The Appointment Booking Plugin WordPress plugin before 5.6.8 does not restrict which booking fields an unauthenticated visitor can set through its public booking funnel, allowing an unauthenticated user to assign a privileged booking field such as the approval status and thereby bypass the site's booking approval workflow.
Affected products
- Appointment Booking Plugin: before 5.6.8 — fixed in 5.6.8
How to fix
Upgrade to a fixed version: Appointment Booking Plugin 5.6.8. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-15250 or the next vulnerability affects your stack