CVE-2026-103380 Information disclosure in Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress
Authenticated subscribers can extract sensitive booking data, including admin notes and payment tokens, by injecting template placeholders into their profile fields.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-103380?
CVE-2026-103380 is a medium-severity vulnerability in Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress, published on 14 Oct 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.7.3 via the 'params[customer][first_name]' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract privileged booking data including the administrator-only admin_notes field, assigned agent internal contact details, transaction tokens, and payment request URLs delivered via rendered notification emails. A LatePoint customer can exploit this by storing a template placeholder such as {{customer_admin_notes}} in their own first_name field via the customer_cabinet__update route, then triggering the password-reset email flow to receive the expanded value in the resulting notification.
Weakness: CWE-200
Which versions are affected by CVE-2026-103380?
How do I fix CVE-2026-103380?
No fix has been published for CVE-2026-103380 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-103380 being exploited?
There is no known exploitation of CVE-2026-103380 in the wild and no public exploit code.
Sources
Also known as GHSA-vx7p-qcxr-ccm5.