Low severity · published Oct 21, 2026
CVE-2026-105257
LatePoint < 5.7.5 - Agent+ Customer PII Disclosure via IDOR
2.7
CVSS
0.3%
EPSS
No
On KEV
Description
The Appointment Booking Plugin WordPress plugin before 5.7.5 does not verify that an authenticated agent-level user is assigned to a customer before returning or searching that customer's record, allowing any agent to read and enumerate the personal information of every customer on the site, including those managed by other agents.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 21% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AB
Appointment Booking Plugin ·
before 5.7.5 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-105257
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-105257
wpscan.com
https://wpscan.com/vulnerability/10a8f09f-8282-456d-ad07-7e594e70a371/
More from Appointment Booking Plugin
5.4
CVE-2026-11866
LatePoint < 5.6.3 - Multiple Privileged Actions via CSRF
5.3
CVE-2026-105198
LatePoint < 5.7.3 - Unauthenticated Customer PII Disclosure via IDOR
5.3
CVE-2026-15250
LatePoint < 5.6.8 - Unauthenticated Booking Object Mass Assignment via Public Booking Funnel
3.3
CVE-2026-105196
LatePoint < 5.6.9 - Agent+ Cross-Agent Data Disclosure and Modification via Abilities API
2.7
CVE-2026-105197
LatePoint < 5.6.5 - Agent+ Arbitrary Order, Customer and Transaction Deletion via IDOR