Attack Vectors

LatePoint – Calendar Booking Plugin for Appointments and Events (slug: latepoint-2) is affected by an authenticated SQL Injection vulnerability in versions up to and including 5.2.7. The issue is tied to the plugin’s JSON Import capability, where attacker-controlled JSON input is not sufficiently validated.

Because the vulnerability requires Administrator-level access or higher (per the CVSS vector’s high privileges requirement), it is most relevant in scenarios such as: compromised admin accounts, shared admin credentials across vendors or agencies, excessive admin permissions for non-technical staff, or insider threat situations. In these cases, an attacker could leverage the JSON Import workflow to submit crafted data designed to manipulate database queries.

Severity is Medium (CVSS 6.5, CVE-2026-1487), but organizations should treat it as a serious business risk because it can directly impact the integrity and confidentiality of data stored in the WordPress database.

Security Weakness

CVE-2026-1487 is caused by insufficient validation of user-supplied JSON data in LatePoint’s JSON Import feature. When input is not properly constrained, it can be interpreted in ways that allow an authenticated attacker to run unintended database commands.

In practical terms, this weakness increases the “blast radius” of an admin-account compromise. Even when an attacker already has elevated privileges, SQL Injection can provide a more direct path to sensitive data access and high-impact data manipulation than typical admin actions, which can accelerate damage and complicate incident response and recovery.

Technical or Business Impacts

With Administrator access, an attacker could potentially execute arbitrary SQL queries against the WordPress database using time-based techniques to extract information, and could also modify or delete data (including dropping tables). For businesses, that can translate into concrete outcomes such as exposure of customer or operational data, loss of booking/appointment records, and disruption to revenue-generating workflows.

For marketing directors and executives, the risk is less about the exploit mechanics and more about downstream impact: damaged customer trust, loss of data integrity in customer journeys (appointments, event records, communications), potential compliance reporting obligations depending on what data is stored, and unplanned costs for incident response, cleanup, and restoring accurate records. The CVSS vector indicates high impact to confidentiality and integrity, which aligns with these business-level concerns.

Remediation: Update LatePoint to version 5.2.8 or newer patched versions. As a complementary control, review who truly needs Administrator access, enforce strong authentication for admin accounts, and monitor administrative actions—especially imports and configuration changes—so suspicious behavior is detected early.

Similar Attacks

SQL Injection has been a recurring cause of major data exposure and service disruption across industries. Examples include:

U.S. DOJ coverage of the 2014 JPMorgan Chase breach (widely reported as involving SQL Injection in the attack chain).

UK ICO enforcement action involving British Airways (a high-profile incident emphasizing how web-application weaknesses can lead to significant regulatory and financial consequences).

Verizon Data Breach Investigations Report (DBIR) (ongoing reporting showing how common web-application attacks—including injection—remain in real-world breaches).