What the vulnerability does
01Description
The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to SQL Injection via the JSON Import in all versions up to, and including, 5.2.7 due to insufficient validation on the user-supplied JSON data. This makes it possible for authenticated attackers, with Administrator-level access and above, to execute arbitrary SQL queries on the database that can be used to extract information via time-based techniques, drop tables, or modify data.
Explanation of Vulnerability in Simple Terms
02Summary
LatePoint versions up to 5.2.7 contain a SQL injection vulnerability in database queries. An authenticated administrator can inject malicious SQL code to read or modify database contents. The vulnerability requires high-level admin access and does not affect data availability. Update to a version newer than 5.2.7.
What an attacker can do
03Attacker Capabilities
Read or modify database records by injecting SQL code into plugin queries.
Potential impact on your site
04Site Impact
An admin account compromise could expose or alter booking data, customer information, and site configuration.
Conditions required to exploit
05Prerequisites
Attacker must have administrator-level access to the WordPress site.
Key dates
06Disclosure timeline
March 3, 2026
CVE published
April 8, 2026
Record updated
