CVE-2026-5356 | The LatePoint – Calendar Booking Plugin for Appointments and… | CVSS 7.5 HIGH

Description

The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Improper Input Validation in all versions up to, and including, 5.4.0. This is due to the plugin's Stripe Connect payment processor accepting a client-supplied PaymentIntent ID. This makes it possible for unauthenticated attackers to pay an arbitrary amount by supplying a previously succeeded PaymentIntent token.

Metadata

CVE ID: CVE-2026-5356
State: PUBLISHED
Assigner: Wordfence
Reserved: 2026-04-01 16:48 UTC
Published: 2026-07-08 12:33 UTC
Last updated: 2026-07-08 15:02 UTC
Primary CWE: CWE-862
CWE-862 Missing Authorization
Vendor / Product: latepoint / LatePoint – Calendar Booking Plugin for Appointments and Events
Sources: cve.org · NVD

Severity & Metrics

7.5 HIGH CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

SSVC — CISA Coordinator

Exploitation: none
Automatable: yes
Tech. Impact: partial

Affected products (1)

Vendor	Product	Platform	Versions
latepoint	LatePoint – Calendar Booking Plugin for Appointments and Events	—	0 ≤ 5.4.0

Weakness (CWE)

CWE	Source	Description
CWE-862	cna	CWE-862 Missing Authorization

CVSS scores (1)

Score	Severity	Version	Source	Vector
7.5	HIGH	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

References (2)