Medium severity · published Jul 30, 2026
CVE-2026-15250
LatePoint < 5.6.8 - Unauthenticated Booking Object Mass Assignment via Public Booking Funnel
5.3
CVSS
0.3%
EPSS
No
On KEV
Description
The Appointment Booking Plugin WordPress plugin before 5.6.8 does not restrict which booking fields an unauthenticated visitor can set through its public booking funnel, allowing an unauthenticated user to assign a privileged booking field such as the approval status and thereby bypass the site's booking approval workflow.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 27% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AB
Appointment Booking Plugin ·
before 5.6.8 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-15250
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-15250
wpscan.com
https://wpscan.com/vulnerability/2609e202-9be3-42b0-a1fb-ace310b93bd0/
More from Appointment Booking Plugin
5.4
CVE-2026-11866
LatePoint < 5.6.3 - Multiple Privileged Actions via CSRF
5.3
CVE-2026-105198
LatePoint < 5.7.3 - Unauthenticated Customer PII Disclosure via IDOR
3.3
CVE-2026-105196
LatePoint < 5.6.9 - Agent+ Cross-Agent Data Disclosure and Modification via Abilities API
2.7
CVE-2026-105257
LatePoint < 5.7.5 - Agent+ Customer PII Disclosure via IDOR
2.7
CVE-2026-105197
LatePoint < 5.6.5 - Agent+ Arbitrary Order, Customer and Transaction Deletion via IDOR