medium4.3
CVE-2026-5365
The LatePoint plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including 5.3.2.
Impact
The LatePoint plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including 5.3.2. This is due to missing nonce verification on the request_cancellation() function. This makes it possible for unauthenticated attackers to cancel a logged-in customer's bookings via a forged request, granted they can trick the customer into performing an action such as clicking on a link.
Affected products
| Product | Affected versions |
|---|---|
| All | through 5.3.2. |
Versions were read from the advisory text. No structured product data has been published for this record yet.