WordPress Plugin Vulnerabilities

Latepoint < 5.1.93 - Unauthenticated Insecure Direct Object Reference

Description

The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.1.92 via the 'view_booking_summary_in_lightbox' due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to retrieve appointment details such as customer names and email addresses.

Affects Plugins

Plugin icon
latepoint
Fixed in 5.1.93

References

CVE
CVE-2025-3769
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/7e9acd26-c341-4ece-bcf1-102f953a4b4f

Classification

Type
IDOR
OWASP top 10
A5: Broken Access Control
CWE
CWE-639
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
Martin Martin
Verified
No
WPVDB ID
7ebe0a3d-d676-4e3e-a2f7-d7d6dc3f929c

Timeline

Publicly Published
2025-05-13 (about 1 year ago)
Added
2025-05-13 (about 1 year ago)
Last Updated
2025-05-14 (about 11 months ago)

Other

Published
Title
Published
2024-06-06
Title
Tutor LMS – eLearning and online course solution < 2.7.2 - Authenticated (Instructor+) Insecure Direct Object Reference to Arbitrary Quiz Attempt Deletion
Published
2025-11-18
Title
Eagle Booking <= 1.3.4.3 - Authenticated (Subscriber+) Insecure Direct Object Reference
Published
2024-01-17
Title
Contact Form builder with drag & drop - Kali Forms < 2.3.37 - Insecure Direct Object Reference
Published
2025-01-02
Title
WP Job Portal – A Complete Recruitment System for Company or Job Board website < 2.2.5 - Authenticated (Subscriber+) Insecure Direct Object Reference
Published
2023-05-15
Title
WooCommerce Ship to Multiple Addresses < 3.8.4 - Subscriber+ Shipping Address Disclosure via IDOR