CVE-2026-5356 — Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress [latepoint] < 5.4.1

CVE	Vulnerability	Type	Severity	Affected	Fixed in	Published	Status
CVE-2026-5356	Appointment Booking Plugin – LatePoint \| Calendar & Scheduling for WordPress [latepoint] < 5.4.1	Missing Authorization	High 7.5	< 5.4.1	5.4.1	2026-07-07	—

CVE-2026-5356

The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Improper Input Validation in all versions up to, and including, 5.4.0. This is due to the plugin's Stripe Connect payment processor accepting a client-supplied PaymentIntent ID. This makes it possible for unauthenticated attackers to pay an arbitrary amount by supplying a previously succeeded PaymentIntent token.

Source: CVE.org

Scan your WordPress site free

No signup, no credit card — enter your URL and get a security report in seconds.

Run a free scan Get the plugin (free)