LatePoint CVE-2026-17538: WordPress Customer Data Tampering, Update Now

The score on CVE-2026-17538 reads 5.4, medium, the kind of number a busy administrator scrolls past. That number is doing the plugin a favor. The flaw lives in LatePoint, a WordPress appointment-booking plugin on more than 100,000 sites, and it lets any logged-in user quietly rewrite the personal details of every customer in the booking system. On a site that invites clients to register so they can manage their own appointments, "logged-in user" means "anyone who signed up."

Wordfence, which assigned the identifier, lists every version up to and including 5.6.9 as vulnerable. The current release is 5.7.4. If you run LatePoint, moving to 5.7.4 or newer is the whole fix. The rest of this post is about why the medium rating understates the exposure, the one setting that turns data tampering into account takeover, and how to tell whether anyone used the gap before you closed it.

How one function skips the owner check

LatePoint drives a booking through its steps with a single request handler. The customer step runs a function named process_step_customer(). According to Wordfence's advisory, that function checks only whether the request comes from a logged-in account, through WordPress's is_user_logged_in() call, before it writes the submitted data onto an existing customer record. It never asks whether the logged-in account owns that record.

This is a textbook insecure direct object reference, usually shortened to IDOR: an application trusts a client-supplied identifier to point at a record without verifying the requester is allowed to touch it. The identifier in the request names a LatePoint customer, and the handler writes to whichever one it is told. An authenticated attacker with Subscriber access, the lowest rung on a WordPress site, can change the name, email, phone number, and private notes on any customer in the system. The CVE record classifies it as CWE-639, authorization bypass through a user-controlled key. It is the same missing-owner-check pattern behind a cross-user flaw we covered in Langflow, applied here to a customer database instead of a workflow engine.

Why "Subscriber-level" is the wrong way to read this

Medium-severity authenticated bugs usually earn a shrug, because the login requirement is a genuine barrier. Here it often is not. LatePoint exists to take bookings from the public, and many deployments let customers create an account to manage appointments. On those sites, Subscriber access is not a privilege an attacker has to steal. It is the front door, handed out on request.

The CVSS vector records the low privilege requirement as PR:L, but a score cannot know that, for this particular product, the privilege is trivial to obtain. That is the gap between a number and a risk. The same flaw in an internal-only tool with no public sign-up would be a fair medium. In a public booking plugin with open registration, it behaves much closer to a pre-authentication issue. Authorization and account-takeover flaws are a steady presence on this beat: they are the third-largest bug class our intel desk triaged over the past 90 days, 1,261 of the events we evaluated, behind only cross-site scripting and command injection.

The setting that turns tampering into takeover

Rewriting a stranger's phone number is a privacy problem. Rewriting their email is a route into their account. LatePoint has a contact_merge setting that controls how it matches a new booking to an existing customer. When it is set to phone, Wordfence reports that an attacker can overwrite the victim's email address on their customer record, then trigger a password reset to the attacker-controlled address and take over the account.

So the real severity turns on a configuration value most site owners have never opened. If contact_merge uses phone matching, treat this as an account-takeover bug rather than a data-integrity one. That conditional cliff is exactly the detail a one-line advisory summary flattens. The escalation path mirrors the Branda account-takeover bug we wrote up this year: overwrite the email, request a reset, own the login.

How to tell if it was used

Patching closes the hole. It does not tell you whether someone walked through it first. Because exploitation is an authenticated web request, it leaves a trail in your WordPress access logs. Every LatePoint step routes through admin-ajax.php with the action parameter latepoint_route_call, so the customer-step requests are visible there.

grep "latepoint_route_call" access.log | grep -i "post"
grep "latepoint_route_call" access.log | awk '{print $1}' | sort | uniq -c | sort -rn

A handful of hits from a logged-in customer is normal booking traffic. One source hammering that route across many different customer records in a short window is not. Cross-reference the busiest source against your user list: a Subscriber account driving that volume is the finding. A managed SIEM watching those logs would surface the burst as it happens, rather than weeks later during an audit. No public proof-of-concept exploit has surfaced as of publication, and the flaw is not on CISA's Known Exploited Vulnerabilities list, which makes now the quiet window to patch in.

Update past 5.6.9, then audit who can register

Three steps, in order:

• Update LatePoint to 5.7.4 or newer. Every version through 5.6.9 is affected, and the current release carries the fix. This is the only step that closes the flaw.
• Check your contact_merge setting. If it uses phone matching, you were exposed to account takeover, not just data edits. Review recent password resets on customer accounts.
• Audit open registration. If your site hands out Subscriber accounts on sign-up, assume the login barrier was no barrier, and run the log hunt above across the weeks before you patched.

A 5.4 is easy to deprioritize. On a plugin whose entire job is collecting the public's names, emails, and phone numbers, and handing them accounts to do it, the score is the least interesting number in the advisory. This is the second WordPress booking-plugin flaw on our desk this season, after an unauthenticated issue in Bookly, another popular scheduler. Patch LatePoint like the takeover bug it can quietly become.