CVE-2026-32533: 
WordPress vulnerability analysis and mitigation

CVE-2026-32533 is an Insecure Direct Object Reference (IDOR) vulnerability in the LatePoint WordPress plugin that allows unauthenticated attackers to bypass authorization controls. It affects LatePoint versions up to and including 5.2.6, with version 5.2.7 containing the fix. The vulnerability was reported on January 30, 2026, and published by Patchstack on March 23–25, 2026. It carries a CVSS v3.1 base score of 6.5 (Medium) (Patchstack).

The vulnerability is classified as CWE-639 (Authorization Bypass Through User-Controlled Key), a form of IDOR where the application uses user-supplied input to directly reference internal objects without adequate authorization checks. An attacker can manipulate object reference keys in requests to access or modify resources belonging to other users. The flaw is exploitable over the network with low attack complexity, requires no authentication, and no user interaction, making it accessible to unauthenticated actors with Subscriber-level or lower privilege context (Patchstack).

Successful exploitation can result in limited confidentiality and integrity impacts — attackers may be able to access sensitive data (e.g., booking records, customer information) or manipulate objects they should not have access to within the LatePoint plugin. Availability is not impacted. The scope is limited to the affected WordPress installation, but exposure of customer booking data could have privacy implications for site operators (Patchstack).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.017% (0.000170), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack notes it is unlikely to be exploited due to its low severity impact, though IDOR vulnerabilities of this type are sometimes used in mass-exploit campaigns targeting WordPress plugins (Patchstack).

The vendor has released LatePoint version 5.2.7, which patches this vulnerability. Site administrators should update the LatePoint plugin to version 5.2.7 or later immediately. Patchstack users can enable auto-update for vulnerable plugins as an additional safeguard. No configuration-based workaround is documented; updating is the only recommended remediation (Patchstack).

Wordfence included this vulnerability in its weekly WordPress vulnerability report for the period of March 23–29, 2026, and Sucuri referenced it in its March 2026 vulnerability patch roundup, indicating routine coverage within the WordPress security community. No notable researcher commentary or significant social media discussion has been identified beyond standard aggregation (Wordfence Blog, Sucuri Blog).