Now officially on WordPress.org

CVE Database / CVE-2026-5356

CVE · High

CVE-2026-5356 — Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress [latepoint] < 5.4.1

CVE Vulnerability Type Severity Affected Fixed in Published Status
CVE-2026-5356 Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress [latepoint] < 5.4.1 Missing Authorization High 7.5 < 5.4.1 5.4.1 2026-07-07 —

CVE-2026-5356

The LatePoint – Calendar Booking Plugin contains a flaw in its Stripe Connect integration, where it fails to properly verify user input. Specifically, the plugin's payment processor accepts a PaymentIntent ID from clients without sufficient validation. As a result, attackers can exploit this weakness by submitting a previously successful PaymentIntent token to pay an arbitrary amount.

Based on public CVE data (MITRE/NVD).

Scan your WordPress site free

No signup, no credit card — enter your URL and get a security report in seconds.

Run a free scan Get the plugin (free)

See the full security page for this plugin Browse the CVE database Browse all security findings