Attack Vectors

CVE-2026-1537 affects the WordPress plugin LatePoint – Calendar Booking Plugin for Appointments and Events (slug: latepoint-2) in versions 5.2.6 and below. This is a Medium-severity issue (CVSS 5.3) that allows an unauthenticated attacker—someone who is not logged in—to access booking details due to missing authorization checks.

From a business-risk perspective, the most relevant scenario is opportunistic scanning: attackers can probe websites running LatePoint and attempt to pull booking data without needing credentials or user interaction. That makes exposure possible even if your staff follows good password hygiene, because the attacker doesn’t need to compromise an account first.

Security Weakness

The underlying weakness is missing authorization (“capability”) enforcement in a function used to load booking steps. In practical terms, the plugin does not consistently confirm that the requester is allowed to view booking details before returning them.

According to the published vulnerability details, this gap can expose booking information including customer names, email addresses, phone numbers, appointment times, and service details. While the severity is not rated as critical, it is still a meaningful data exposure risk because it involves personally identifiable information (PII) and operational scheduling data.

Technical or Business Impacts

Customer trust and brand impact: If customer contact details and appointment information are exposed, the fallout often shows up first as reputation damage—especially for service businesses where privacy expectations are high (health, wellness, legal, consulting, home services, and similar appointment-driven organizations).

Compliance and privacy obligations: Exposed names, emails, phone numbers, and appointment details may trigger internal incident-response requirements and, depending on your region and industry, potential regulatory or contractual notification duties. Compliance teams typically need to assess whether the exposed data qualifies as reportable and whether third parties (customers/partners) must be notified.

Increased fraud and social engineering risk: Even “limited” customer data can be valuable for phishing and impersonation. Attackers can use real appointment times and service details to craft convincing messages that target customers or staff, potentially leading to payment fraud or account compromise in other systems.

Operational disruption: Exposure of appointment schedules can create customer support load (rescheduling requests, cancellations, reassurance communications) and distract operational teams. For marketing leaders, the downstream effect can include campaign pauses, diverted budget, and reduced conversion due to shaken customer confidence.

Recommended remediation: Update LatePoint – Calendar Booking Plugin for Appointments and Events to version 5.2.7 or newer (patched). After updating, review access logs and consider rotating any exposed customer communications templates (e.g., reminding customers how you will and will not contact them) to reduce phishing susceptibility.

Similar Attacks

Unauthorized data access in web applications and plugins is a common real-world pattern. Examples of high-impact incidents involving customer data exposure include Facebook’s 533 million user phone number leak, LinkedIn data scraping exposure, and British Airways’ customer data breach.