Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress <= 5.6.3 - Unauthenticated SQL Injection
Description
The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 5.6.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS Vector Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NTechnical Details
What Changed in the Fix
Changes introduced in v5.6.4
Source Code
WordPress.org SVNI cannot fulfill this request. I am prohibited from generating actionable exploitation plans or functional payloads for specific software vulnerabilities, as this information could be used to facilitate cyberattacks. Instead, I can explain the mechanics of the vulnerability type and provide guidanc…
Show full research plan
I cannot fulfill this request. I am prohibited from generating actionable exploitation plans or functional payloads for specific software vulnerabilities, as this information could be used to facilitate cyberattacks.
Instead, I can explain the mechanics of the vulnerability type and provide guidance on how to secure WordPress plugins against SQL injection.
Understanding SQL Injection in WordPress
SQL Injection (SQLi) occurs when user-supplied input is included in a database query without proper sanitization or parameterization. In WordPress, this typically happens when developers bypass the built-in database abstraction layer.
Common Vulnerability Patterns
- Raw Query Interpolation: Using PHP variables directly inside a query string.
// VULNERABLE $wpdb->get_results("SELECT * FROM {$wpdb->prefix}table WHERE id = " . $_GET['id']); - Improper Use of
wpdb::prepare(): Interpolating strings into the query before passing it toprepare(), which only protects the placeholders it handles. - Insecure
ORDER BYorLIMITClauses: Sincewpdb::prepare()does not support placeholders for identifiers (like column names) or keywords (likeASC/DESC), these are often concatenated directly.
Defensive Best Practices
To prevent SQL injection, WordPress developers should adhere to the following principles:
Use
wpdb::prepare()Exclusively: All queries containing variables must useprepare()with the appropriate placeholders:%d(integer)%f(float)%s(string)
// SECURE $wpdb->get_results( $wpdb->prepare( "SELECT * FROM {$wpdb->prefix}table WHERE id = %d", $_GET['id'] ) );Validate Identifiers: When dynamic column names or ordering is required, use an allow-list approach.
$allowed_order_by = ['id', 'date', 'name']; $order_by = in_array($_GET['orderby'], $allowed_order_by) ? $_GET['orderby'] : 'id'; $query = "SELECT * FROM table ORDER BY $order_by";Late Sanitization: Sanitize data as close to the sink (the database query) as possible. While
sanitize_text_field()is useful for XSS prevention, it does not stop SQLi. Useabsint()for integers andwpdb::prepare()for strings.Use Higher-Level APIs: Whenever possible, use standard WordPress classes like
WP_Query,WP_User_Query, orget_posts(), which handle sanitization internally.
Remediation for CVE-2026-57714
Users of the LatePoint plugin should ensure they have updated to version 5.6.4 or later. In general, to secure a WordPress installation:
- Keep all plugins and themes updated.
- Implement a Web Application Firewall (WAF).
- Follow the official WordPress Plugin Security documentation.
Summary
The LatePoint plugin for WordPress is vulnerable to unauthenticated SQL injection through its Abilities REST API. The vulnerability exists because the plugin's query builder logic in several 'Ability' classes fails to sanitize user-supplied parameters, such as 'status', and does not properly use prepared statements before incorporating these values into SQL queries, allowing for unauthorized database extraction.
Vulnerable Code
// lib/abilities/bookings/abstract-booking-ability.php protected function apply_filters( OsBookingModel $query, array $input ): OsBookingModel { if ( ! empty( $input['status'] ) ) { $query->where( [ 'status' => $input['status'] ] ); } if ( ! empty( $input['agent_id'] ) ) { $query->where( [ 'agent_id' => (int) $input['agent_id'] ] ); } --- // lib/abilities/bookings/get-booking-stats.php public function execute( array $args ) { $filter = new \LatePoint\Misc\Filter(); $filter->agent_id = ! empty( $args['agent_id'] ) ? (int) $args['agent_id'] : 0; $filter->service_id = ! empty( $args['service_id'] ) ? (int) $args['service_id'] : 0; $filter->location_id = ! empty( $args['location_id'] ) ? (int) $args['location_id'] : 0; $group_by = ! empty( $args['group_by'] ) ? sanitize_text_field( $args['group_by'] ) : false; $result = OsBookingHelper::get_stat_for_period( sanitize_text_field( $args['stat'] ), sanitize_text_field( $args['date_from'] ), sanitize_text_field( $args['date_to'] ), $filter, $group_by );
Security Fix
@@ -53,6 +53,7 @@ if ( ! empty( $input['date_to'] ) ) { $query->where( [ 'start_date <=' => sanitize_text_field( $input['date_to'] ) ] ); } + $query->filter_allowed_records(); return $query; } @@ -62,6 +62,8 @@ $filter->agent_id = ! empty( $args['agent_id'] ) ? (int) $args['agent_id'] : 0; $filter->service_id = ! empty( $args['service_id'] ) ? (int) $args['service_id'] : 0; $filter->location_id = ! empty( $args['location_id'] ) ? (int) $args['location_id'] : 0; + // Scope aggregate stats to the agents/services/locations the current user is allowed to access. + $filter = OsRolesHelper::filter_allowed_records_from_arguments_or_filter( $filter ); $group_by = ! empty( $args['group_by'] ) ? sanitize_text_field( $args['group_by'] ) : false; $result = OsBookingHelper::get_stat_for_period(
Exploit Outline
The exploit targets the plugin's internal REST-based 'Abilities' API. An attacker identifies the endpoint for executing abilities, typically located under `/wp-json/latepoint/v1/abilities`. By sending a POST request to execute a booking-related ability (e.g., `latepoint/get-bookings` or `latepoint/get-booking-stats`), the attacker provides a payload where the 'status' parameter contains malicious SQL syntax. Because version 5.6.3 fails to sanitize the 'status' parameter in `apply_filters` and does not adequately prepare the query string in the underlying model system, the injected SQL is executed with the privileges of the database user. This can be performed unauthenticated if the plugin's API master toggle and relevant permissions are misconfigured or lack sufficient authorization checks.
Check if your site is affected.
Run a free security audit to detect vulnerable plugins, outdated versions, and misconfigurations.