[ CVE-2026-105256 · Published 21 Oct 2026 ]
Vulnerability in Unknown LatePoint
CVSS 5.3
EPSS <1%No fix listed yet
[ Description ]Official description
The LatePoint WordPress plugin before 5.7.5 does not validate the client-supplied value that determines how much is charged for a booking against the amounts the service and site actually allow, allowing an unauthenticated visitor to make the amount due resolve to zero and obtain a confirmed appointment and a recorded order without completing any payment.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.