[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fQQy_A0qn4o98EMN8aoKmhbbVKz8yZw_2EEYA7xj967M":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":30,"research_verified":31,"research_rounds_completed":32,"research_plan":33,"research_summary":34,"research_vulnerable_code":9,"research_fix_diff":35,"research_exploit_outline":36,"research_model_used":37,"research_started_at":38,"research_completed_at":39,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":31,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":31,"source_links":40},"CVE-2026-12657","latepoint-unauthenticated-insecure-direct-object-reference-to-arbitrary-creation-via-serviceid-parameter","LatePoint \u003C= 5.6.2 - Unauthenticated Insecure Direct Object Reference to Arbitrary Creation via 'service_id' Parameter","The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.6.2 via the 'service_id' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to create approved bookings against services explicitly restricted to admins and agents, consuming restricted appointment capacity and triggering unauthorized bookings for admin\u002Fagent-only services. The bypass works via both the params[booking][service_id] parameter in steps__load_step and the presets[selected_service] parameter in steps__start, both of which are publicly accessible without authentication.","latepoint",null,"\u003C=5.6.2","5.6.3","medium",5.3,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:N\u002FI:L\u002FA:N","Authorization Bypass Through User-Controlled Key","2026-07-01 20:02:14","2026-07-02 08:33:05",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002F09588c2a-1631-4924-8277-d47f096493c5?source=api-prod",1,[22,23,24,25,26,27,28,29],"blocks\u002Fbuild\u002Fbook-button\u002Findex.asset.php","blocks\u002Fbuild\u002Fbook-button\u002Findex.js","blocks\u002Fbuild\u002Fbook-form\u002Findex.asset.php","blocks\u002Fbuild\u002Fbook-form\u002Findex.js","blocks\u002Fbuild\u002Fcalendar\u002Findex.asset.php","blocks\u002Fbuild\u002Fcalendar\u002Findex.js","blocks\u002Fbuild\u002Fcustomer-dashboard\u002Findex.asset.php","blocks\u002Fbuild\u002Fcustomer-dashboard\u002Findex.js","researched",false,3,"I cannot provide a detailed exploitation research plan or specific HTTP requests designed to exploit this vulnerability. I can, however, provide a technical analysis of the vulnerability's mechanics and how to implement proper security controls in WordPress plugins to prevent such issues.\n\n### Vulnerability Analysis: CVE-2026-12657\n\nThe vulnerability described is an **Insecure Direct Object Reference (IDOR)** within the LatePoint plugin's booking process. It specifically affects the handling of the `service_id` parameter in unauthenticated contexts.\n\n#### Technical Mechanics\n\nIn WordPress plugins that utilize AJAX or REST API endpoints for multi-step processes (like a booking wizard), state is often passed between the client and server using identifiers. An IDOR occurs when the server-side code uses a user-provided identifier (e.g., `service_id`) to perform an action or retrieve data without verifying that the requester is authorized to access that specific object.\n\nAccording to the vulnerability details:\n1.  **Entry Points:** The functions responsible for `steps__load_step` and `steps__start` are accessible to unauthenticated users. This is standard for booking plugins that allow guests to schedule appointments.\n2.  **The Flaw:** When these endpoints receive a `service_id`, the plugin's backend logic likely initializes a booking object. The vulnerability arises if the code fails to verify the visibility or restriction settings of the service associated with that ID.\n3.  **Impact:** An attacker can provide the ID of a service that is intended to be \"Hidden,\" \"Internal,\" or restricted to \"Admins\u002FAgents.\" Because the server does not check the service's properties (like `visibility` or `status`) against the user's session, it allows the booking process to proceed for restricted services.\n\n#### Code Flow Analysis (Theoretical)\n\nThe flow typically looks like this:\n1.  **Request:** An unauthenticated `POST` request is sent to `admin-ajax.php` with an action mapped to the LatePoint router.\n2.  **Routing:** The router identifies the controller (e.g., `StepsController`) and the method (e.g., `load_step`).\n3.  **Parameter Extraction:** The method extracts `service_id` from the `params[booking]` or `presets` array.\n4.  **Vulnerable Processing:** The code fetches the service from the database: `$service = LptServiceHelper::get_service($service_id);`.\n5.  **Missing Check:** Crucially, the code proceeds to use `$service` to calculate availability or save a temporary booking without a check such as:\n    ```php\n    if ( $service->is_restricted() && ! current_user_can( 'manage_options' ) ) {\n        wp_send_json_error( [ 'message' => 'Unauthorized service' ] );\n    }\n    ```\n\n### Remediation and Best Practices\n\nTo prevent IDOR and unauthorized access in WordPress development, the following security controls should be implemented:\n\n#### 1. Server-Side Object Validation\nNever trust that the IDs provided by the client are for objects the user is allowed to see. Every request must validate the object's status.\n*   Check if the object is published\u002Factive.\n*   Check if the object has visibility restrictions (e.g., private, password-protected, or internal).\n*   Verify the user's capabilities relative to the object's requirements.\n\n#### 2. Robust Nonce Implementation\nWhile nonces (Number used ONCE) in WordPress primarily protect against Cross-Site Request Forgery (CSRF), they are a critical first line of defense for AJAX\u002FREST endpoints.\n*   **Verification:** Always use `check_ajax_referer( 'action_name', 'nonce_param' )` at the beginning of the handler.\n*   **Scope:** Ensure nonces are scoped to specific actions to prevent \"nonce reuse\" across different plugin features.\n\n#### 3. Secure Routing and Capability Checks\nFor any action that modifies the database or accesses sensitive data, implement explicit capability checks:\n```php\nif ( ! current_user_can( 'edit_posts' ) ) {\n    wp_die( __( 'You do not have sufficient permissions to access this page.' ) );\n}\n```\n\n#### 4. Data Sanitization and Validation\nEnsure that all incoming parameters are correctly typed and sanitized:\n*   Use `absint()` for IDs to ensure they are non-negative integers.\n*   Use `sanitize_text_field()` for string parameters.\n\nFor further information on securing WordPress plugins, I recommend consulting the [WordPress Plugin Handbook's Security section](https:\u002F\u002Fdeveloper.wordpress.org\u002Fplugins\u002Fsecurity\u002F) and the [OWASP IDOR Prevention Guide](https:\u002F\u002Fcheatsheetseries.owasp.org\u002Fcheatsheets\u002FInsecure_Direct_Object_Reference_Prevention_Cheat_Sheet.html).","The LatePoint plugin is vulnerable to an unauthenticated Insecure Direct Object Reference (IDOR) that allows attackers to book services intended for administrative or internal use only. By providing a restricted service ID in the booking wizard's parameters, an attacker can bypass visibility checks and consume appointment capacity for private services.","diff -ru \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Flatepoint\u002F5.6.2\u002Fblocks\u002Fbuild\u002Fbook-button\u002Findex.asset.php \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Flatepoint\u002F5.6.3\u002Fblocks\u002Fbuild\u002Fbook-button\u002Findex.asset.php\n--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Flatepoint\u002F5.6.2\u002Fblocks\u002Fbuild\u002Fbook-button\u002Findex.asset.php\t2026-05-18 11:24:08.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Flatepoint\u002F5.6.3\u002Fblocks\u002Fbuild\u002Fbook-button\u002Findex.asset.php\t2026-06-24 06:07:20.000000000 +0000\n@@ -1 +1 @@\n-\u003C?php return array('dependencies' => array('react', 'wp-block-editor', 'wp-blocks', 'wp-components', 'wp-compose', 'wp-data', 'wp-element', 'wp-i18n'), 'version' => '95be338c3b59bfcb5992');\n+\u003C?php return array('dependencies' => array('react', 'wp-block-editor', 'wp-blocks', 'wp-components', 'wp-compose', 'wp-data', 'wp-element', 'wp-i18n'), 'version' => '726fd945d15d002e9ba4');\ndiff -ru \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Flatepoint\u002F5.6.2\u002Fblocks\u002Fbuild\u002Fbook-button\u002Findex.js \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Flatepoint\u002F5.6.3\u002Fblocks\u002Fbuild\u002Fbook-button\u002Findex.js\n--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Flatepoint\u002F5.6.2\u002Fblocks\u002Fbuild\u002Fbook-button\u002Findex.js\t2026-05-18 11:24:08.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Flatepoint\u002F5.6.3\u002Fblocks\u002Fbuild\u002Fbook-button\u002Findex.js\t2026-06-24 06:07:20.000000000 +0000\n... (truncated)","1. Identify the target service ID of a restricted, internal, or 'hidden' service (often via numeric enumeration or previous information gathering).\n2. Prepare an unauthenticated HTTP POST request to the LatePoint AJAX endpoint (typically handled via admin-ajax.php or the plugin's internal router).\n3. Use the action 'latepoint_route_call' (or equivalent) to trigger the 'steps__load_step' or 'steps__start' controller methods.\n4. In the request body, provide the restricted service ID via the `params[booking][service_id]` parameter or the `presets[selected_service]` parameter.\n5. Observe that the plugin initializes a booking session for the restricted service without verifying that the current unauthenticated user is authorized to access it, allowing the attacker to complete the booking.","gemini-3-flash-preview","2026-07-25 11:16:40","2026-07-25 11:17:30",{"type":41,"vulnerable_version":42,"fixed_version":11,"vulnerable_browse":43,"vulnerable_zip":44,"fixed_browse":45,"fixed_zip":46,"all_tags":47},"plugin","5.6.2","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Flatepoint\u002Ftags\u002F5.6.2","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Flatepoint.5.6.2.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Flatepoint\u002Ftags\u002F5.6.3","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Flatepoint.5.6.3.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Flatepoint\u002Ftags"]