[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fQIJyygkstOLlm9Har9MG9vviXHKHXv1nj2BEdAETO_Q":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":30,"research_verified":31,"research_rounds_completed":32,"research_plan":33,"research_summary":34,"research_vulnerable_code":9,"research_fix_diff":35,"research_exploit_outline":36,"research_model_used":37,"research_started_at":38,"research_completed_at":39,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":31,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":31,"source_links":40},"CVE-2026-11398","latepoint-missing-authorization-to-unauthenticated-arbitrary-customer-data-modification-via-processstepcustomer-booking-","LatePoint \u003C= 5.6.1 - Missing Authorization to Unauthenticated Arbitrary Customer Data Modification via process_step_customer() Booking Form Customer Step","The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.6.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to modify the personally identifiable information (first name, last name, phone number, and notes) of any existing customer record, including those linked to administrator accounts, by submitting the booking form with a known customer's email address. Exploitation requires the plugin to be configured with guest bookings enabled (is_customer_auth_disabled() returning true), which is necessary for the vulnerable unauthenticated code path in process_step_customer() to be reached.","latepoint",null,"\u003C=5.6.1","5.6.2","medium",5.3,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:N\u002FI:L\u002FA:N","Missing Authorization","2026-07-02 19:22:32","2026-07-03 07:53:10",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002Fe4dcedcc-2878-47b2-99f0-ecba2cc33b69?source=api-prod",1,[22,23,24,25,26,27,28,29],"blocks\u002Fbricks\u002Fbricks_widget_book_button.php","blocks\u002Fbricks\u002Fbricks_widget_book_form.php","blocks\u002Fbuild\u002Fbook-button\u002Fblock.json","blocks\u002Fbuild\u002Fbook-form\u002Fblock.json","blocks\u002Felementor\u002Felementor_widget_book_button.php","blocks\u002Felementor\u002Felementor_widget_book_form.php","blocks\u002Fsrc\u002Fbook-button\u002Fblock.json","blocks\u002Fsrc\u002Fbook-form\u002Fblock.json","researched",false,3,"This research plan targets **CVE-2026-11398**, a missing authorization vulnerability in the **LatePoint** plugin (\u003C= 5.6.1). The vulnerability allows unauthenticated attackers to modify customer PII (First Name, Last Name, Phone, and Notes) by exploiting the `process_step_customer()` logic when guest bookings are enabled.\n\n---\n\n### 1. Vulnerability Summary\nThe vulnerability exists within the `process_step_customer()` method, which handles the customer information step in the LatePoint booking process. When the plugin is configured to allow guest bookings (i.e., `is_customer_auth_disabled()` returns true), the code path for unauthenticated users fails to verify if the requester has the authority to modify an existing customer record identified by email. If an attacker submits a booking form using the email address of an existing customer (including administrators who have customer records), the plugin updates that customer's metadata with the attacker-supplied values.\n\n### 2. Attack Vector Analysis\n*   **Endpoint:** `wp-admin\u002Fadmin-ajax.php`\n*   **Action:** `latepoint_route_call` (The standard AJAX gateway for LatePoint)\n*   **Route:** `bookings__process_step_customer` (The specific controller\u002Faction route)\n*   **Vulnerable Parameter:** `customer[]` array (specifically `email`, `first_name`, `last_name`, `phone`, `notes`)\n*   **Authentication:** None (Unauthenticated)\n*   **Precondition:** Guest bookings must be enabled in LatePoint settings.\n\n### 3. Code Flow\n1.  **Entry Point:** An unauthenticated user sends a POST request to `admin-ajax.php?action=latepoint_route_call`.\n2.  **Routing:** The LatePoint router processes `route_name=bookings__process_step_customer`.\n3.  **Vulnerable Function:** The `BookingsController` invokes `process_step_customer()`.\n4.  **Authorization Check:** The function checks `is_customer_auth_disabled()`. If true, it proceeds to process the `customer` parameters.\n5.  **Lookup & Update:** The code searches for an existing customer by the provided `email`. If found, it populates the customer object with the new `first_name`, `last_name`, `phone`, and `notes` and calls `save()`.\n6.  **Sink:** The database is updated with attacker-controlled PII without requiring a password or session token matching the target email.\n\n### 4. Nonce Acquisition Strategy\nLatePoint typically requires a nonce for its AJAX routing. This nonce is usually generated for the `latepoint_route_call` action.\n\n1.  **Identify Shortcode:** The booking form is rendered via the `[latepoint_book_form]` shortcode.\n2.  **Create Trigger Page:**\n    ```bash\n    wp post create --post_type=page --post_title=\"Booking\" --post_status=publish --post_content='[latepoint_book_form]'\n    ```\n3.  **Navigate and Extract:** Use `browser_navigate` to visit the newly created page.\n4.  **JS Evaluation:** The LatePoint settings and nonces are typically localized into a global JavaScript object. Based on the plugin structure, look for the `latepoint_helper` object.\n    *   **Action:** `browser_eval(\"window.latepoint_helper?.latepoint_nonce\")` (inferred).\n    *   **Alternative:** If not in `latepoint_helper`, check for `latepoint_settings.nonce`.\n\n### 5. Exploitation Strategy\nOnce the nonce and a target email (e.g., the admin email) are obtained, perform the unauthorized modification.\n\n*   **Request Method:** POST\n*   **URL:** `http:\u002F\u002F\u003Ctarget>\u002Fwp-admin\u002Fadmin-ajax.php`\n*   **Headers:** `Content-Type: application\u002Fx-www-form-urlencoded`\n*   **Body Parameters:**\n    *   `action`: `latepoint_route_call`\n    *   `route_name`: `bookings__process_step_customer`\n    *   `latepoint_nonce`: `\u003CEXTRACTED_NONCE>`\n    *   `customer[email]`: `\u003CTARGET_CUSTOMER_EMAIL>`\n    *   `customer[first_name]`: `Modified_By_Exploit`\n    *   `customer[last_name]`: `CVE-2026-11398`\n    *   `customer[phone]`: `555-000-9999`\n    *   `customer[notes]`: `Unauthorized data modification successful.`\n\n### 6. Test Data Setup\n1.  **Create a Target Customer:**\n    ```bash\n    # Create a customer associated with the admin email\n    wp user create victim victim@example.com --role=administrator\n    # LatePoint creates customer records when a user interacts with the booking system.\n    # We can force this or manually create a customer record in the latepoint_customers table.\n    ```\n2.  **Enable Guest Bookings:**\n    Navigate to **LatePoint Settings -> Customers** and ensure \"Allow Guest Bookings\" is enabled.\n    *   Alternatively, via WP-CLI (if the option name is known):\n        `wp option update latepoint_is_customer_auth_disabled \"1\"` (inferred).\n\n### 7. Expected Results\n*   The server should return a JSON response indicating success (e.g., `{\"status\": \"success\", ...}`).\n*   The customer record associated with the target email will have its PII updated to the attacker-supplied values.\n\n### 8. Verification Steps\nAfter sending the exploit request, verify the modification using WP-CLI to inspect the LatePoint customer data:\n```bash\n# Check the latepoint_customers table\nwp db query \"SELECT first_name, last_name, phone, notes FROM wp_latepoint_customers WHERE email='victim@example.com';\"\n```\nIf the output reflects \"Modified_By_Exploit\", the vulnerability is confirmed.\n\n### 9. Alternative Approaches\n*   **No Nonce Path:** Check if `process_step_customer()` can be reached via a direct `REST API` route if registered, which might have different (or missing) nonce requirements.\n*   **Targeting Admins:** If the admin has never booked an appointment, they may not have a record in `wp_latepoint_customers`. In this case, the exploit might create a *new* customer record with the admin's email, which could lead to account takeover if the plugin later links WordPress users to LatePoint customers based solely on email.","The LatePoint plugin for WordPress is vulnerable to an authorization bypass in its booking process up to version 5.6.1. When guest bookings are enabled, the plugin fails to verify the identity of a user submitting the booking form, allowing unauthenticated attackers to modify the name, phone number, and notes of any existing customer record (including administrators) simply by using their email address.","diff -ru \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Flatepoint\u002F5.6.1\u002Fblocks\u002Fbricks\u002Fbricks_widget_book_button.php \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Flatepoint\u002F5.6.2\u002Fblocks\u002Fbricks\u002Fbricks_widget_book_button.php\n--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Flatepoint\u002F5.6.1\u002Fblocks\u002Fbricks\u002Fbricks_widget_book_button.php\t2025-01-31 06:58:28.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Flatepoint\u002F5.6.2\u002Fblocks\u002Fbricks\u002Fbricks_widget_book_button.php\t2026-06-15 08:21:00.000000000 +0000\n@@ -373,28 +373,32 @@\n \t\u002F\u002F Render element HTML\n \tpublic function render() {\n \n-\t\t$allowed_params = [\n-\t\t\t'caption',\n-\t\t\t'hide_summary',\n-\t\t\t'hide_side_panel',\n-\t\t\t'selected_agent',\n-\t\t\t'selected_service',\n-\t\t\t'selected_bundle',\n-\t\t\t'selected_service_category',\n-\t\t\t'selected_location',\n-\t\t\t'selected_start_date',\n-\t\t\t'selected_start_time',\n-\t\t\t'selected_duration',\n-\t\t\t'selected_total_attendees',\n-\t\t\t'source_id',\n-\t\t\t'calendar_start_date',\n-\t\t\t'show_services',\n-\t\t\t'show_service_categories',\n-\t\t\t'show_agents',\n-\t\t\t'show_locations',\n-\t\t\t'btn_wrapper_classes',\n-\t\t\t'btn_classes'\n-\t\t];\n+\t\t$allowed_params = apply_filters(\n+\t\t\t'latepoint_book_widget_allowed_params',\n+\t\t\t[\n+\t\t\t\t'caption',\n+\t\t\t\t'hide_summary',\n+\t\t\t\t'hide_side_panel',\n+\t\t\t\t'selected_agent',\n+\t\t\t\t'selected_service',\n+\t\t\t\t'selected_bundle',\n+\t\t\t\t'selected_service_category',\n+\t\t\t\t'selected_location',\n+\t\t\t\t'selected_start_date',\n+\t\t\t\t'selected_start_time',\n+\t\t\t\t'selected_duration',\n+\t\t\t\t'selected_total_attendees',\n+\t\t\t\t'source_id',\n+\t\t\t\t'calendar_start_date',\n+\t\t\t\t'show_services',\n+\t\t\t\t'show_service_categories',\n+\t\t\t\t'show_agents',\n+\t\t\t\t'show_locations',\n+\t\t\t\t'btn_wrapper_classes',\n+\t\t\t\t'btn_classes',\n+\t\t\t],\n+\t\t\t'bricks_book_button'\n+\t\t);\n \n ... (truncated)","The exploit targets the `process_step_customer()` logic within the `BookingsController`. \n\n1. **Prerequisite**: The plugin must have 'Allow Guest Bookings' enabled in the LatePoint settings.\n2. **Identify Target**: Locate the email address of an existing customer record (e.g., an administrator who has previously used the booking system).\n3. **Nonce Extraction**: Visit any page where the LatePoint booking form is active (via shortcode or block) and extract the `latepoint_nonce` from the global JavaScript objects (e.g., `latepoint_helper.latepoint_nonce`).\n4. **Execution**: Send an unauthenticated POST request to `wp-admin\u002Fadmin-ajax.php` with the action set to `latepoint_route_call` and the `route_name` set to `bookings__process_step_customer`.\n5. **Payload**: In the request body, include a `customer` array containing the target's `email` and the attacker's desired values for `first_name`, `last_name`, `phone`, and `notes`. \n6. **Result**: Because the plugin checks for an existing customer by email and immediately updates the record if found (without verifying a session or password), the target's PII is overwritten.","gemini-3-flash-preview","2026-07-25 09:44:59","2026-07-25 09:45:37",{"type":41,"vulnerable_version":42,"fixed_version":11,"vulnerable_browse":43,"vulnerable_zip":44,"fixed_browse":45,"fixed_zip":46,"all_tags":47},"plugin","5.6.1","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Flatepoint\u002Ftags\u002F5.6.1","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Flatepoint.5.6.1.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Flatepoint\u002Ftags\u002F5.6.2","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Flatepoint.5.6.2.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Flatepoint\u002Ftags"]