CVE Explorer
CVE-2026-13228
The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Privilege Escalation to Administrator in versions up to, and including, 5.6.3 This is due to an Insecure Direct Object Reference (IDOR) in the create_or_update() function of OsOrdersController, which allows an authenticated Agent to supply an arbitrary order[customer_id] and overwrite any LatePoint customer's email field (including one linked to a WordPress Administrator's account) through t
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
0
Affected products and versions
1 source assertion{"defaultStatus":"unaffected","product":"LatePoint – Calendar Booking Plugin for Appointments and Events","vendor":"latepoint","versions":[{"lessThanOrEqual":"5.6.3","status":"affected","version":"0","versionType":"semver"}]}
- cve_program_cvelist_v5affectedurn:baitaphish:normalized-source-record:v2:d8f37d17ede018c2a939abf1a00da8fc686e08acef51be720efb184d8d0363cf · sha256:6e4a6871afccae33… · /containers/cna/affected/0
Provider-owned CVSS observations
1 source assertion{"metric":{"baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"metric_type":"cvssV3_1"}
- cve_program_cvelist_v5cvssurn:baitaphish:normalized-source-record:v2:d8f37d17ede018c2a939abf1a00da8fc686e08acef51be720efb184d8d0363cf · sha256:6e4a6871afccae33… · /containers/cna/metrics/0/cvssV3_1
CWE assertions
1 source assertion{"cweId":"CWE-269","description":"CWE-269 Improper Privilege Management","lang":"en","type":"CWE"}
- cve_program_cvelist_v5cweurn:baitaphish:normalized-source-record:v2:d8f37d17ede018c2a939abf1a00da8fc686e08acef51be720efb184d8d0363cf · sha256:6e4a6871afccae33… · /containers/cna/problemTypes/0/descriptions/0
Source references
7 source assertions{"url":"https://plugins.trac.wordpress.org/browser/latepoint/tags/5.6.2/lib/controllers/orders_controller.php#L112"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:d8f37d17ede018c2a939abf1a00da8fc686e08acef51be720efb184d8d0363cf · sha256:6e4a6871afccae33… · /containers/cna/references/4
{"url":"https://plugins.trac.wordpress.org/browser/latepoint/tags/5.6.2/lib/controllers/orders_controller.php#L127"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:d8f37d17ede018c2a939abf1a00da8fc686e08acef51be720efb184d8d0363cf · sha256:6e4a6871afccae33… · /containers/cna/references/1
{"url":"https://plugins.trac.wordpress.org/browser/latepoint/tags/5.6.2/lib/controllers/orders_controller.php#L137"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:d8f37d17ede018c2a939abf1a00da8fc686e08acef51be720efb184d8d0363cf · sha256:6e4a6871afccae33… · /containers/cna/references/2
{"url":"https://plugins.trac.wordpress.org/browser/latepoint/tags/5.6.2/lib/helpers/auth_helper.php#L256"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:d8f37d17ede018c2a939abf1a00da8fc686e08acef51be720efb184d8d0363cf · sha256:6e4a6871afccae33… · /containers/cna/references/3
{"url":"https://plugins.trac.wordpress.org/changeset/3590914/latepoint/trunk/lib/controllers/orders_controller.php"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:d8f37d17ede018c2a939abf1a00da8fc686e08acef51be720efb184d8d0363cf · sha256:6e4a6871afccae33… · /containers/cna/references/5
{"url":"https://plugins.trac.wordpress.org/changeset?old_path=%2Flatepoint/tags/5.6.3&new_path=%2Flatepoint/tags/5.6.4"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:d8f37d17ede018c2a939abf1a00da8fc686e08acef51be720efb184d8d0363cf · sha256:6e4a6871afccae33… · /containers/cna/references/6
{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8f9db3b8-dd37-4d8b-b041-50b453858a39?source=cve"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:d8f37d17ede018c2a939abf1a00da8fc686e08acef51be720efb184d8d0363cf · sha256:6e4a6871afccae33… · /containers/cna/references/0
Attribution and limitations
- CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →
Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.