CVE-2026-5234

The LatePoint plugin for WordPress has a flaw in its handling of invoices that allows unauthorized access to sensitive financial data. In versions up to 5.3.2, an attacker can exploit this vulnerability by accessing public actions without authentication, which enables them to enumerate valid invoice IDs and create unauthorized transaction intent records containing customer information and payment amounts. This also results in the disclosure of Stripe payment tokens and other related details on sites with Stripe Connect enabled.

Based on public CVE data (MITRE/NVD).