WordPress Plugin Vulnerabilities

LatePoint < 5.4.1 - Unauthenticated Payment Bypass via Client-Supplied Stripe PaymentIntent ID

Description

The plugin is vulnerable to a payment amount-binding bypass. Its Stripe Connect payment processor accepts a client-supplied PaymentIntent ID, making it possible for unauthenticated attackers to complete a booking for an arbitrary amount by supplying a previously succeeded PaymentIntent token instead of paying the intended price.

Affects Plugins

Plugin icon
latepoint
Fixed in 5.4.1

References

CVE
CVE-2026-5356
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/1b1338c4-36a8-47b0-b3cf-c5dc690f8c1c

Miscellaneous

Original Researcher
Andrés Cruciani
Verified
No
WPVDB ID
586a5e8b-0319-47bd-a27a-1d3a88e5739f

Timeline

Publicly Published
2026-07-07 (about 1 month ago)
Added
2026-07-08 (about 1 month ago)
Last Updated
2026-07-08 (about 1 month ago)

Other

Published
Title
Published
2026-07-20
Title
Five Star Restaurant Reservations < 2.7.23 - Unauthenticated Payment Bypass and Booking Confirmation via IDOR
Published
2022-04-07
Title
SiteGround Security < 1.2.6 - Authentication Bypass via 2-FA Authentication Setup
Published
2022-03-25
Title
Safe SVG < 1.9.10 - SVG Sanitisation Bypass
Published
2019-09-18
Title
Social Metrics Tracker <= 1.6.8 - Unauthorised Data Export
Published
2022-12-27
Title
FluentAuth < 1.0.2 - Bypass blocks by IP Spoofing