CVE-2026-5356

The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Improper Input Validation in all versions up to, and including, 5.4.0. This is due to the plugin's Stripe Connect payment processor accepting a client-supplied PaymentIntent ID. This makes it possible for unauthenticated attackers to pay an arbitrary amount by supplying a previously succeeded PaymentIntent token.

• CWE-862

• https://plugins.trac.wordpress.org/changeset/3509569/latepoint
• https://www.wordfence.com/threat-intel/vulnerabilities/id/1b1338c4-36a8-47b0-b3cf-c5dc690f8c1c?source=cve

Published

Jul 8, 2026

Last Modified

Jul 8, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-53539Python-Multipart is a streaming multipart parser for Python.…7.5
• CVE-2026-5354A flaw has been found in Trendnet TEW-657BRM 1.00.1. Affecte…8.8
• CVE-2026-53540Python-Multipart is a streaming multipart parser for Python.…3.7
• CVE-2026-5355A vulnerability has been found in Trendnet TEW-657BRM 1.00.1…8.8
• CVE-2026-53550js-yaml is a JavaScript YAML parser and dumper. Prior to 4.2…5.3
• CVE-2026-53551free5GC is an open-source implementation of the 5G core netw…6.9
• CVE-2026-53565Improper Privilege Management vulnerability in Citrix Secure…8.5
• CVE-2026-53566Out-of-bounds read vulnerability in Citrix Citrix Secure Acc…6.8
• CVE-2026-53568Frappe is a full-stack web application framework. Prior to v…6.9
• CVE-2026-5357The Download Manager plugin for WordPress is vulnerable to S…6.4
• CVE-2026-53571Vite is a frontend tooling framework for JavaScript. Prior t…7.5
• CVE-2026-53573GeoNetwork is a catalog application to manage spatially refe…4.8