CVE-2026-1487
Last modified
CVE-2026-1487 is a medium-severity vulnerability rated 6.5/10 on the CVSS scale. The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to SQL Injection via the JSON Import in all versions up to, and including, 5.2.7 due to insufficient validation on the user-supplied JSON data. This makes it possible for authenticated attackers, with Administrator-level access and above, to execute arbitrary SQL queries on the database that can be used to extract information via time-based techniques, drop tables, or modify data.. EPSS estimates a 0.32% chance of exploitation in the next 30 days.
Description
The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to SQL Injection via the JSON Import in all versions up to, and including, 5.2.7 due to insufficient validation on the user-supplied JSON data. This makes it possible for authenticated attackers, with Administrator-level access and above, to execute arbitrary SQL queries on the database that can be used to extract information via time-based techniques, drop tables, or modify data.
Metrics
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-1487?
How severe is CVE-2026-1487?
How do I fix CVE-2026-1487?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-14863FileRun up to and including version 2026.2.0 contains an OS …8.8
- CVE-2026-14864The JetEngine WordPress plugin before 3.8.12 does not escape…5.4
- CVE-2026-14865In Progress® Telerik® UI for AJAX prior to v2026.2.708, the …5.3
- CVE-2026-14867Credentials of built-in users are insecurely stored in the U…5.5
- CVE-2026-14868The encryption algorithm used to protect the configuration o…5.5
- CVE-2026-14869The terraform-mcp-server before version 1.1.0 is vulnerable …8.6
- CVE-2026-14870The Database for Contact Form 7, WPforms, Elementor forms Wo…7.1
- CVE-2026-14871osTicket versions v1.18.3 and v1.17.7 contain a Broken Objec…7.1
- CVE-2026-14872The Database for Contact Form 7, WPforms, Elementor forms Wo…6.8
- CVE-2026-14881When importing connections in Compass it is possible to over…8.4
- CVE-2026-14886Vault Enterprise's identity entity batch-delete endpoint is …8.2
- CVE-2026-1489A flaw was found in GLib. An integer overflow vulnerability …5.4
Are you affected by CVE-2026-1487?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST