CVE-2026-111602

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.7.4 via the 'params (customer[uuid])' parameter. This makes it possible for unauthenticated attackers to extract the first name, last name, email address, phone number, and notes of every customer record in the database by enumerating uuid prefixes via the unauthenticated steps__load_step AJAX endpoint. This vulnerability is only exploitable when the LatePoint plugin is configured with the 'Field used for authentication' setting set to 'Disable ability to login' (guest checkout mode).

• CWE-200

• https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.4/lib/controllers/steps_controller.php#L355
• https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.4/lib/helpers/params_helper.php#L14
• https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.4/lib/helpers/steps_helper.php#L1175
• https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.4/lib/models/model.php#L379
• https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.5/lib/controllers/steps_controller.php
• https://www.wordfence.com/threat-intel/vulnerabilities/id/6afce24f-30cd-4aeb-a5dd-20bd80a75779?source=cve

Published

Oct 17, 2026

Last Modified

Oct 19, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-111593Rejected reason: This CVE ID was reserved for a reported iss…
• CVE-2026-111594InterSystems IRIS for Health has TLS/SSL encryption turned o…8.1
• CVE-2026-111596The Kliken: Ads + Pixel for Meta WordPress plugin before 1.2…5.3
• CVE-2026-1116A Cross-site Scripting (XSS) vulnerability was identified in…6.1
• CVE-2026-11160Out of bounds read in Input in Google Chrome on Linux prior …6.5
• CVE-2026-111601The Hippoo Mobile App for WooCommerce plugin for WordPress i…6.1
• CVE-2026-111603PlayEdu through 2.3 contains a missing authorization vulnera…4.3
• CVE-2026-111604eladmin through 2.7 contains an authorization bypass vulnera…3.8
• CVE-2026-111605Jpom through 2.11.12 contains an authorization bypass vulner…8.1
• CVE-2026-111606Huly Platform through 0.7.432 contains a missing authorizati…8.1
• CVE-2026-111607Jeepay through 3.2.9 contains an insecure direct object refe…7.1
• CVE-2026-111608Jeepay through 3.2.9 contains an insecure direct object refe…4.2