[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fGJqmuS-qugssiTvqvQq1Yl9nU7Vs5jUOtxUqef-PAC8":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":30,"research_verified":31,"research_rounds_completed":32,"research_plan":33,"research_summary":34,"research_vulnerable_code":35,"research_fix_diff":36,"research_exploit_outline":37,"research_model_used":38,"research_started_at":39,"research_completed_at":40,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":31,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":31,"source_links":41},"CVE-2026-57714","appointment-booking-plugin-latepoint-calendar-scheduling-for-wordpress-unauthenticated-sql-injection","Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress \u003C= 5.6.3 - Unauthenticated SQL Injection","The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 5.6.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.","latepoint",null,"\u003C=5.6.3","5.6.4","high",7.5,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:N\u002FA:N","Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","2026-07-08 00:00:00","2026-07-14 19:37:26",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002F7b0eff94-6fb9-4caf-b60d-f92f63a41915?source=api-prod",7,[22,23,24,25,26,27,28,29],"latepoint.php","lib\u002Fabilities\u002Fabstract-ability.php","lib\u002Fabilities\u002Fbookings\u002Fabstract-booking-ability.php","lib\u002Fabilities\u002Fbookings\u002Fchange-booking-status.php","lib\u002Fabilities\u002Fbookings\u002Fdelete-booking.php","lib\u002Fabilities\u002Fbookings\u002Fget-booking-stats.php","lib\u002Fabilities\u002Fbookings\u002Fget-booking.php","lib\u002Fabilities\u002Fbookings\u002Fget-bookings-per-day.php","researched",false,3,"I cannot fulfill this request. I am prohibited from generating actionable exploitation plans or functional payloads for specific software vulnerabilities, as this information could be used to facilitate cyberattacks.\n\nInstead, I can explain the mechanics of the vulnerability type and provide guidance on how to secure WordPress plugins against SQL injection.\n\n### Understanding SQL Injection in WordPress\n\nSQL Injection (SQLi) occurs when user-supplied input is included in a database query without proper sanitization or parameterization. In WordPress, this typically happens when developers bypass the built-in database abstraction layer.\n\n#### Common Vulnerability Patterns\n1.  **Raw Query Interpolation:** Using PHP variables directly inside a query string.\n    ```php\n    \u002F\u002F VULNERABLE\n    $wpdb->get_results(\"SELECT * FROM {$wpdb->prefix}table WHERE id = \" . $_GET['id']);\n    ```\n2.  **Improper Use of `wpdb::prepare()`:** Interpolating strings into the query before passing it to `prepare()`, which only protects the placeholders it handles.\n3.  **Insecure `ORDER BY` or `LIMIT` Clauses:** Since `wpdb::prepare()` does not support placeholders for identifiers (like column names) or keywords (like `ASC`\u002F`DESC`), these are often concatenated directly.\n\n### Defensive Best Practices\n\nTo prevent SQL injection, WordPress developers should adhere to the following principles:\n\n1.  **Use `wpdb::prepare()` Exclusively:** All queries containing variables must use `prepare()` with the appropriate placeholders:\n    *   `%d` (integer)\n    *   `%f` (float)\n    *   `%s` (string)\n\n    ```php\n    \u002F\u002F SECURE\n    $wpdb->get_results(\n        $wpdb->prepare(\n            \"SELECT * FROM {$wpdb->prefix}table WHERE id = %d\",\n            $_GET['id']\n        )\n    );\n    ```\n\n2.  **Validate Identifiers:** When dynamic column names or ordering is required, use an allow-list approach.\n    ```php\n    $allowed_order_by = ['id', 'date', 'name'];\n    $order_by = in_array($_GET['orderby'], $allowed_order_by) ? $_GET['orderby'] : 'id';\n    $query = \"SELECT * FROM table ORDER BY $order_by\";\n    ```\n\n3.  **Late Sanitization:** Sanitize data as close to the sink (the database query) as possible. While `sanitize_text_field()` is useful for XSS prevention, it does not stop SQLi. Use `absint()` for integers and `wpdb::prepare()` for strings.\n\n4.  **Use Higher-Level APIs:** Whenever possible, use standard WordPress classes like `WP_Query`, `WP_User_Query`, or `get_posts()`, which handle sanitization internally.\n\n### Remediation for CVE-2026-57714\nUsers of the LatePoint plugin should ensure they have updated to version **5.6.4** or later. In general, to secure a WordPress installation:\n*   Keep all plugins and themes updated.\n*   Implement a Web Application Firewall (WAF).\n*   Follow the official [WordPress Plugin Security](https:\u002F\u002Fdeveloper.wordpress.org\u002Fplugins\u002Fsecurity\u002F) documentation.","The LatePoint plugin for WordPress is vulnerable to unauthenticated SQL injection through its Abilities REST API. The vulnerability exists because the plugin's query builder logic in several 'Ability' classes fails to sanitize user-supplied parameters, such as 'status', and does not properly use prepared statements before incorporating these values into SQL queries, allowing for unauthorized database extraction.","\u002F\u002F lib\u002Fabilities\u002Fbookings\u002Fabstract-booking-ability.php\n\tprotected function apply_filters( OsBookingModel $query, array $input ): OsBookingModel {\n\t\tif ( ! empty( $input['status'] ) ) {\n\t\t\t$query->where( [ 'status' => $input['status'] ] );\n\t\t}\n\t\tif ( ! empty( $input['agent_id'] ) ) {\n\t\t\t$query->where( [ 'agent_id' => (int) $input['agent_id'] ] );\n\t\t}\n\n---\n\n\u002F\u002F lib\u002Fabilities\u002Fbookings\u002Fget-booking-stats.php\n\tpublic function execute( array $args ) {\n\t\t$filter              = new \\LatePoint\\Misc\\Filter();\n\t\t$filter->agent_id    = ! empty( $args['agent_id'] ) ? (int) $args['agent_id'] : 0;\n\t\t$filter->service_id  = ! empty( $args['service_id'] ) ? (int) $args['service_id'] : 0;\n\t\t$filter->location_id = ! empty( $args['location_id'] ) ? (int) $args['location_id'] : 0;\n\n\t\t$group_by = ! empty( $args['group_by'] ) ? sanitize_text_field( $args['group_by'] ) : false;\n\t\t$result   = OsBookingHelper::get_stat_for_period(\n\t\t\tsanitize_text_field( $args['stat'] ),\n\t\t\tsanitize_text_field( $args['date_from'] ),\n\t\t\tsanitize_text_field( $args['date_to'] ),\n\t\t\t$filter,\n\t\t\t$group_by\n\t\t);","diff -ru \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Flatepoint\u002F5.6.3\u002Flib\u002Fabilities\u002Fbookings\u002Fabstract-booking-ability.php \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Flatepoint\u002F5.6.4\u002Flib\u002Fabilities\u002Fbookings\u002Fabstract-booking-ability.php\n--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Flatepoint\u002F5.6.3\u002Flib\u002Fabilities\u002Fbookings\u002Fabstract-booking-ability.php\t2026-03-10 07:15:14.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Flatepoint\u002F5.6.4\u002Flib\u002Fabilities\u002Fbookings\u002Fabstract-booking-ability.php\t2026-06-30 05:53:20.000000000 +0000\n@@ -53,6 +53,7 @@\n \t\tif ( ! empty( $input['date_to'] ) ) {\n \t\t\t$query->where( [ 'start_date \u003C=' => sanitize_text_field( $input['date_to'] ) ] );\n \t\t}\n+\t\t$query->filter_allowed_records();\n \t\treturn $query;\n \t}\n\ndiff -ru \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Flatepoint\u002F5.6.3\u002Flib\u002Fabilities\u002Fbookings\u002Fget-booking-stats.php \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Flatepoint\u002F5.6.4\u002Flib\u002Fabilities\u002Fbookings\u002Fget-booking-stats.php\n--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Flatepoint\u002F5.6.3\u002Flib\u002Fabilities\u002Fbookings\u002Fget-booking-stats.php\t2026-03-10 07:15:14.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Flatepoint\u002F5.6.4\u002Flib\u002Fabilities\u002Fbookings\u002Fget-booking-stats.php\t2026-06-30 05:53:20.000000000 +0000\n@@ -62,6 +62,8 @@\n \t\t$filter->agent_id    = ! empty( $args['agent_id'] ) ? (int) $args['agent_id'] : 0;\n \t\t$filter->service_id  = ! empty( $args['service_id'] ) ? (int) $args['service_id'] : 0;\n \t\t$filter->location_id = ! empty( $args['location_id'] ) ? (int) $args['location_id'] : 0;\n+\t\t\u002F\u002F Scope aggregate stats to the agents\u002Fservices\u002Flocations the current user is allowed to access.\n+\t\t$filter = OsRolesHelper::filter_allowed_records_from_arguments_or_filter( $filter );\n \n \t\t$group_by = ! empty( $args['group_by'] ) ? sanitize_text_field( $args['group_by'] ) : false;\n \t\t$result   = OsBookingHelper::get_stat_for_period(","The exploit targets the plugin's internal REST-based 'Abilities' API. An attacker identifies the endpoint for executing abilities, typically located under `\u002Fwp-json\u002Flatepoint\u002Fv1\u002Fabilities`. By sending a POST request to execute a booking-related ability (e.g., `latepoint\u002Fget-bookings` or `latepoint\u002Fget-booking-stats`), the attacker provides a payload where the 'status' parameter contains malicious SQL syntax. Because version 5.6.3 fails to sanitize the 'status' parameter in `apply_filters` and does not adequately prepare the query string in the underlying model system, the injected SQL is executed with the privileges of the database user. This can be performed unauthenticated if the plugin's API master toggle and relevant permissions are misconfigured or lack sufficient authorization checks.","gemini-3-flash-preview","2026-07-16 14:32:41","2026-07-16 14:33:37",{"type":42,"vulnerable_version":43,"fixed_version":11,"vulnerable_browse":44,"vulnerable_zip":45,"fixed_browse":46,"fixed_zip":47,"all_tags":48},"plugin","5.6.3","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Flatepoint\u002Ftags\u002F5.6.3","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Flatepoint.5.6.3.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Flatepoint\u002Ftags\u002F5.6.4","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Flatepoint.5.6.4.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Flatepoint\u002Ftags"]