CVE-2026-11398: 
WordPress vulnerability analysis and mitigation

CVE-2026-11398 is an authorization bypass vulnerability in the LatePoint – Calendar Booking Plugin for Appointments and Events for WordPress, affecting all versions up to and including 5.6.1. The flaw allows unauthenticated network attackers to modify personally identifiable information (PII) of any existing customer record, including those associated with administrator accounts. It was published on July 3, 2026, with a patch made available the same day. The vulnerability carries a CVSS v3.1 base score of 5.3 (Medium) (GitHub Advisory).

The vulnerability is classified as CWE-862 (Missing Authorization). The plugin fails to properly verify that a user is authorized to perform an action within the process_step_customer() function, which is reachable without authentication when the plugin is configured with guest bookings enabled (i.e., is_customer_auth_disabled() returns true). An attacker can submit the booking form with a known customer's email address to overwrite that customer's first name, last name, phone number, and notes fields. Relevant vulnerable code paths are documented in steps_controller.php and steps_helper.php (GitHub Advisory).

Successful exploitation allows an unauthenticated attacker to modify PII fields (first name, last name, phone number, and notes) for any customer record in the LatePoint plugin database, including records linked to WordPress administrator accounts. There is no confidentiality or availability impact; the risk is limited to unauthorized data modification (integrity impact). While this does not directly enable account takeover or code execution, tampering with administrator contact details could facilitate social engineering or disrupt business operations (GitHub Advisory).

1. Reconnaissance: Identify WordPress sites running the LatePoint plugin (versions ≤ 5.6.1) using passive techniques such as checking plugin paths (e.g., /wp-content/plugins/latepoint/) or public plugin enumeration tools.
2. Verify guest bookings enabled: Attempt to access the LatePoint booking form without authentication. If the form allows guest submissions (no login required), the is_customer_auth_disabled() condition is likely true, making the vulnerable code path reachable.
3. Identify target customer email: Obtain a known customer email address (e.g., through a public booking confirmation, OSINT, or brute-force of common addresses).
4. Submit crafted booking form: Submit the booking form's customer step (process_step_customer()) with the target customer's email address and attacker-controlled values for first name, last name, phone number, and notes fields.
5. PII overwritten: The plugin processes the submission without authorization checks, updating the target customer's record in the database with the attacker-supplied data (GitHub Advisory).

• Logs: WordPress access logs showing repeated POST requests to the LatePoint booking step endpoint (e.g., /wp-admin/admin-ajax.php or equivalent booking form action) with varying customer data but the same or enumerated email addresses.
• Database: Unexpected changes to customer records in the LatePoint database tables, particularly modifications to first_name, last_name, phone, and notes fields for existing customers, especially administrator-linked accounts.
• Network: High volume of booking form submissions from a single IP or range of IPs, particularly targeting the customer step of the booking process without completing a full booking flow.

Update the LatePoint plugin to a version beyond 5.6.1 that addresses this authorization bypass (a patch was made available on July 3, 2026, per the plugin changeset). As an interim workaround, disable the guest bookings feature in the plugin settings (ensuring is_customer_auth_disabled() returns false) to prevent unauthenticated access to the vulnerable code path. Additionally, review existing customer records for unauthorized modifications and monitor booking form submissions for anomalous activity (GitHub Advisory).

Wordfence included this vulnerability in their weekly WordPress vulnerability report for the period of June 29 – July 5, 2026, noting it as part of their threat intelligence coverage (Wordfence Blog). No significant broader media coverage or notable researcher commentary beyond standard vulnerability tracking has been identified.