CVE-2026-94432 json
Appointment Booking Plugin <= 5.7.1 - Insecure Direct Object Reference to Unauthenticated Unauthorized Transaction Intent Creation/Modification and Invoice Enumeration via 'invoice_id' Parameter
published 2026-10-02 38 d ago modified 2026-10-03 36 d ago also EUVD-2026-91258
- cvss
- 5.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 18%
- public exploits
- 0
- none known
Summary
The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 5.7.1 via the OsPaypalConnectController::create_order_for_transaction() action registered as a public (unauthenticated) route through wp_ajax_nopriv_latepoint_route_call. The handler loads an OsInvoiceModel by a sequential integer 'invoice_id' with no access-key/UUID or ownership check (the sibling Stripe and Razorpay handlers require a 128-bit access-key UUID via OsInvoicesHelper::get_invoice_by_key), and then calls OsTransactionIntentHelper::create_or_update_transaction_intent() which persists a transaction intent tied to the target invoice's customer_id, order_id and charge_amount and regenerates its intent_key before the PayPal-configured guard is reached. This makes it possible for unauthenticated attackers to enumerate invoices belonging to arbitrary customers, create unauthorized transaction-intent rows linked to another customer's data, and overwrite the intent_key of any in-flight NEW-status transaction intent — invalidating the intent_key that legitimate Stripe/Razorpay flows are waiting on and breaking payment webhooks for those customers.
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 36 d ago
Exploit prediction
0.27% chance of exploitation in the next 30 days, higher than 18% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
Affected products
- latepoint Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress
Classification
- Weakness
-
- CWE-639 Authorization Bypass Through User-Controlled Key
- Technology feeds
References
- wordfence.com /threat-intel/vulnerabilities/id/e101bc4e-1c5d-4f30-a1eb-617b0db92723?source=cve
- plugins.trac.wordpress.org /browser/latepoint/tags/5.7.0/lib/controllers/paypal_connect_controller.php#L31
- plugins.trac.wordpress.org /browser/latepoint/tags/5.7.0/lib/controllers/paypal_connect_controller.php#L20
- plugins.trac.wordpress.org /browser/latepoint/tags/5.7.0/lib/helpers/transaction_intent_helper.php#L85
- plugins.trac.wordpress.org /browser/latepoint/tags/5.7.0/latepoint.php#L1072
- plugins.trac.wordpress.org /browser/latepoint/tags/5.7.0/lib/controllers/controller.php#L57
- plugins.trac.wordpress.org /changeset?reponame=&old=3709058%40latepoint&new=3709058%40latepoint
Sources
- CVE List CVE-2026-94432
- NVD CVE-2026-94432
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.