CVE Database /
CVE-2026-11398
CVE · Medium
CVE-2026-11398 — Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress [latepoint] < 5.6.2
| CVE |
Vulnerability |
Type |
Severity |
Affected |
Fixed in |
Published |
Status |
|
CVE-2026-11398
|
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress [latepoint] < 5.6.2 |
Missing Authorization |
Medium
5.3
|
< 5.6.2
|
5.6.2 |
2026-07-02 |
—
|
CVE-2026-11398
The LatePoint – Calendar Booking Plugin for Appointments and Events on WordPress has a security flaw that allows unauthorized access to sensitive data. Specifically, any user can modify customer records by submitting a booking form with an existing email address, even if they're not authenticated. This vulnerability affects all plugin versions up to 5.6.1, particularly when guest bookings are enabled.
Based on public CVE data (MITRE/NVD).
Scan your WordPress site free
No signup, no credit card — enter your URL and get a security report in seconds.
See the full security page for this plugin
Browse the CVE database
Browse all security findings