CVE-2026-94432

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 5.7.1 via the OsPaypalConnectController::create_order_for_transaction() action registered as a public (unauthenticated) route through wp_ajax_nopriv_latepoint_route_call. The handler loads an OsInvoiceModel by a sequential integer 'invoice_id' with no access-key/UUID or ownership check (the sibling Stripe and Razorpay handlers require a 128-bit access-key UUID via OsInvoicesHelper::get_invoice_by_key), and then calls OsTransactionIntentHelper::create_or_update_transaction_intent() which persists a transaction intent tied to the target invoice's customer_id, order_id and charge_amount and regenerates its intent_key before the PayPal-configured guard is reached. This makes it possible for unauthenticated attackers to enumerate invoices belonging to arbitrary customers, create unauthorized transaction-intent rows linked to another customer's data, and overwrite the intent_key of any in-flight NEW-status transaction intent — invalidating the intent_key that legitimate Stripe/Razorpay flows are waiting on and breaking payment webhooks for those customers.

• CWE-639

• https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.0/latepoint.php#L1072
• https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.0/lib/controllers/controller.php#L57
• https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.0/lib/controllers/paypal_connect_controller.php#L20
• https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.0/lib/controllers/paypal_connect_controller.php#L31
• https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.0/lib/helpers/transaction_intent_helper.php#L85
• https://plugins.trac.wordpress.org/changeset?reponame=&old=3709058%40latepoint&new=3709058%40latepoint
• https://www.wordfence.com/threat-intel/vulnerabilities/id/e101bc4e-1c5d-4f30-a1eb-617b0db92723?source=cve

Published

Oct 2, 2026

Last Modified

Oct 3, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-94422An incorrect implementation of message filtering in xdg-dbus…8.8
• CVE-2026-94423Net::LibSSH versions before 0.004 for Perl authenticate to a…9.1
• CVE-2026-94424A vulnerability has been found in Moore Threads MTT S80 Driv…8.8
• CVE-2026-94425A vulnerability was found in Moore Threads MTT S80 Driver Pa…8.8
• CVE-2026-94426A vulnerability was determined in xuxueli xxl-job up to 3.5.…3.5
• CVE-2026-9443A security vulnerability has been detected in Edimax BR-6478…8.8
• CVE-2026-94439When an HTTP server handler sends a 2xx response to an HTTP/…7.5
• CVE-2026-9444A vulnerability was detected in SourceCodester Simple POS an…4.7
• CVE-2026-94440Parsing a multipart form can bypass memory limits and read a…7.5
• CVE-2026-94444Previously, a user operating inside of a malicious Go projec…7.8
• CVE-2026-94445A malicious txtar could escape the intended execution contex…8.8
• CVE-2026-94447Previously, a user operating inside of a malicious Go projec…7.8