CVE-2026-9719

The LatePoint plugin, used in WordPress installations up to version 5.6.0, contains a security flaw that allows unauthorized access to modifying invoice statuses. Specifically, the change_status function fails to properly verify user authorization, enabling malicious actors to manipulate invoices by exploiting this vulnerability through a manipulated request. This could result in unintended changes, such as marking unpaid invoices as paid without administrator approval.

Based on public CVE data (MITRE/NVD).