CVE-2026-12657: 
WordPress vulnerability analysis and mitigation

CVE-2026-12657 is an Insecure Direct Object Reference (IDOR) vulnerability in the LatePoint – Calendar Booking Plugin for Appointments and Events for WordPress. It affects all versions up to and including 5.6.2, allowing unauthenticated attackers to bypass service access restrictions and create approved bookings for admin/agent-only services. The vulnerability was published on July 2, 2026, and carries a CVSS v3.1 base score of 5.3 (Medium) (Feedly, Wordfence).

The root cause is an Authorization Bypass Through User-Controlled Key (CWE-639): the plugin fails to validate the service_id parameter against the authenticated user's permissions before processing booking requests. Two publicly accessible endpoints are affected without requiring authentication: the params[booking][service_id] parameter in the steps__load_step action and the presets[selected_service] parameter in the steps__start action. By supplying the ID of a restricted service in either parameter, an unauthenticated attacker can bypass access controls and create bookings as if they were an authorized admin or agent (Feedly).

Successful exploitation allows unauthenticated attackers to create approved bookings against services explicitly restricted to administrators and agents, consuming restricted appointment capacity and triggering unauthorized bookings. The primary impact is on integrity (unauthorized data modification/creation) with no direct confidentiality or availability impact per the CVSS scoring. This could disrupt business operations by exhausting appointment slots for restricted services or generating fraudulent booking records (Feedly).

1. Reconnaissance: Identify WordPress sites running the LatePoint plugin (version ≤ 5.6.2) by searching for plugin-specific assets (e.g., /wp-content/plugins/latepoint/) using tools like WPScan, Shodan, or Google dorks.
2. Enumerate service IDs: Browse the booking widget on the target site to observe valid service_id values exposed in normal booking flows, or enumerate IDs sequentially via the public endpoints.
3. Identify restricted services: Attempt to load steps for various service IDs using the steps__load_step action with the params[booking][service_id] parameter to identify services that are normally restricted to admins/agents.
4. Craft malicious booking request: Send an unauthenticated HTTP POST request to the WordPress AJAX endpoint (e.g., wp-admin/admin-ajax.php) with the action steps__load_step or steps__start, supplying the restricted service's ID in the respective parameter.
5. Complete booking: Follow the booking flow using the restricted service ID to submit a complete booking, which the plugin approves without validating the caller's authorization, consuming restricted capacity and generating an unauthorized booking record (Feedly).

• Network: Repeated unauthenticated POST requests to wp-admin/admin-ajax.php with action=steps__load_step or action=steps__start containing params[booking][service_id] or presets[selected_service] values corresponding to restricted services.
• Logs: WordPress access logs showing high volumes of AJAX requests to booking endpoints from unauthenticated sessions (no valid session cookie or nonce); sequential or unusual service ID values in request parameters.
• Application Data: Unexpected approved bookings in the LatePoint admin panel for services configured as admin/agent-only; bookings with no associated registered user account or with guest details not matching expected clientele.

Users should update the LatePoint – Calendar Booking Plugin to a version beyond 5.6.2 that addresses this vulnerability; check the WordPress plugin repository or the vendor's site for the patched release. Until a patch is applied, administrators can consider restricting access to the WordPress AJAX endpoint for unauthenticated users via web application firewall (WAF) rules targeting the affected actions (steps__load_step, steps__start). Wordfence users may benefit from firewall rules that detect and block exploitation attempts against this vulnerability (Wordfence).

Wordfence included CVE-2026-12657 in its weekly WordPress vulnerability report for the period of June 29 – July 5, 2026, highlighting it as part of a broader set of plugin vulnerabilities tracked that week (Wordfence). No significant independent researcher commentary or broader media coverage has been identified at this time.