What the vulnerability does
01Description
The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.2.5. This is due to the 'call_by_route_name' function in the routing layer only validating user capabilities without enforcing nonce verification. This makes it possible for unauthenticated attackers to perform multiple administrative actions via forged requests granted they can trick a site administrator into performing an action such as clicking on a link.
Explanation of Vulnerability in Simple Terms
02Summary
LatePoint versions up to 5.2.5 contain a cross-site request forgery (CSRF) vulnerability that allows attackers to perform unwanted actions on behalf of site visitors. An attacker can craft a malicious link or page that, when visited by a logged-in user, triggers unintended changes to booking or calendar settings. The vulnerability requires user interaction but does not compromise data confidentiality.
What an attacker can do
03Attacker Capabilities
Trick a logged-in user into performing unwanted booking or calendar actions without their knowledge.
Potential impact on your site
04Site Impact
Bookings, appointments, or calendar settings could be modified or deleted by attackers exploiting your users' active sessions.
Conditions required to exploit
05Prerequisites
Victim must visit an attacker-controlled page or click a malicious link while logged into the site.
Key dates
06Disclosure timeline
February 14, 2026
CVE published
April 8, 2026
Record updated
