Low severity · published Oct 8, 2026
CVE-2026-105196
LatePoint < 5.6.9 - Agent+ Cross-Agent Data Disclosure and Modification via Abilities API
3.3
CVSS
0.1%
EPSS
No
On KEV
Description
The Appointment Booking Plugin WordPress plugin before 5.6.9 does not enforce per-record authorization on several of its AI Abilities API actions, allowing an authenticated user holding the LatePoint Agent role, normally restricted to their own records, to read and modify other agents' profile data and read other agents' bookings and associated customer details when the Abilities API feature is enabled.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N
Attack vector
Network
Complexity
High
Privileges
High
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 3% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AB
Appointment Booking Plugin ·
before 5.6.9 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-105196
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-105196
exploit
https://wpscan.com/vulnerability/b7b6c989-b484-4ad6-844c-1dec1c74c34d/
More from Appointment Booking Plugin
5.4
CVE-2026-11866
LatePoint < 5.6.3 - Multiple Privileged Actions via CSRF
5.3
CVE-2026-105198
LatePoint < 5.7.3 - Unauthenticated Customer PII Disclosure via IDOR
5.3
CVE-2026-15250
LatePoint < 5.6.8 - Unauthenticated Booking Object Mass Assignment via Public Booking Funnel
2.7
CVE-2026-105257
LatePoint < 5.7.5 - Agent+ Customer PII Disclosure via IDOR
2.7
CVE-2026-105197
LatePoint < 5.6.5 - Agent+ Arbitrary Order, Customer and Transaction Deletion via IDOR