CVE-2026-18441

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.6.9 via the set_customer_object due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to enumerate arbitrary customer records and disclose personally identifiable information - including first name, last name, email address, and phone number - by iterating the customer[id] parameter. This issue is exploitable only when the site is configured with customer authentication disabled (guest checkout enabled).

• CWE-639

• https://plugins.trac.wordpress.org/browser/latepoint/tags/5.6.9/latepoint.php#L1006
• https://plugins.trac.wordpress.org/browser/latepoint/tags/5.6.9/lib/controllers/steps_controller.php#L341
• https://plugins.trac.wordpress.org/browser/latepoint/tags/5.6.9/lib/helpers/steps_helper.php#L1184
• https://plugins.trac.wordpress.org/browser/latepoint/tags/5.6.9/lib/models/model.php#L574
• https://www.wordfence.com/threat-intel/vulnerabilities/id/d80ed885-43f8-43a4-bc61-e9ef92e3207e?source=cve

Published

Sep 18, 2026

Last Modified

Sep 19, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-18435The Kadence Blocks — Page Builder Toolkit for Gutenberg Edit…6.4
• CVE-2026-18436The MailPress plugin for WordPress is vulnerable to unauthor…5.3
• CVE-2026-18437The MailerPress – Newsletter, email marketing & AI automatio…5.3
• CVE-2026-18438The Templately – Elementor & Gutenberg Template Library: 650…8.8
• CVE-2026-18439The Tutor LMS – eLearning and online course solution plugin …4.3
• CVE-2026-1844The PixelYourSite PRO plugin for WordPress is vulnerable to …7.2
• CVE-2026-18442The WCFM Marketplace – Multivendor Marketplace for WooCommer…7.5
• CVE-2026-18444There is an integer conversion vulnerability resulting in an…7.8
• CVE-2026-18445There is an integer overflow vulnerability resulting in an o…7.8
• CVE-2026-18446fast-uri before 4.1.2, 3.1.5, and 2.4.4 requires a literal d…7.5
• CVE-2026-1845The Real Estate Pro plugin for WordPress is vulnerable to St…5.5
• CVE-2026-18452DMS+ (Non-Mobile) developed by Rich Source has a Use of Hard…10