CVE-2026-5365

The LatePoint plugin for WordPress contains a security flaw that allows unauthorized individuals to exploit a vulnerability in all versions prior to 5.3.2, where a malicious actor can simulate a legitimate cancellation request without proper authentication checks. This is particularly concerning because it enables attackers to manipulate bookings made by logged-in customers through deceitful tactics like convincing them to click on a suspicious link.

Based on public CVE data (MITRE/NVD).