CVE-2026-103366

{
  "etk_id": "ETK-2026-1869",
  "cve_id": "CVE-2026-103366",
  "display_id": "CVE-2026-103366",
  "ghsa_id": "GHSA-3pf7-5297-2ffv",
  "euvd_id": "EUVD-2026-100901",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Insecure direct object reference in LatePoint for WordPress",
  "summary": "LatePoint for WordPress versions 5.7.3 and earlier expose booking and cart records without verifying that the requester owns them. An unauthenticated remote attacker may access other customers’ appointment details and pending checkout information through publicly reachable plugin routes.",
  "mitigation": "Update to a vendor release later than 5.7.3 once confirmed available. Until then, restrict public access to the affected LatePoint routes or disable the plugin to reduce exposure.",
  "vendor": "latepoint",
  "product": "Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, <= 5.7.3"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": 7.5,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
  "epss_score": 0.0048,
  "epss_percentile": 0.3978,
  "epss_asof": "2026-10-20",
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "differential",
  "exploit": false,
  "pipeline_minutes": 49.32536973333333,
  "t0_at": "2026-10-14T07:43:31.890000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-17T10:30:39.149545+00:00",
      "days": 3.1160562447337963,
      "is_lower_bound": false,
      "measured_at": "2026-10-14T07:43:31.890000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-10-14T07:43:31.890000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-14T07:43:31.890000+00:00",
      "url": "https://github.com/advisories/GHSA-3pf7-5297-2ffv"
    }
  }
}