Veille CVE

Octobre 2026

6 CVE

Critique 0 Élevée 0 Moyenne 3 Faible 3 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « Unknown Appointment Booking Plugin » ✕
  1. CVE-2026-105256 5.3 Moyenne

    Unknown LatePoint

    The LatePoint WordPress plugin before 5.7.5 does not validate the client-supplied value that determines how much is charged for a booking against the amounts the service and site actually allow, allowing an unauthenticated visitor to make the amount due resolve to zero and obtain a confirmed appointment and a recorded order without completing any payment.

  2. CVE-2026-105257 2.7 Faible

    Unknown Appointment Booking Plugin

    The Appointment Booking Plugin WordPress plugin before 5.7.5 does not verify that an authenticated agent-level user is assigned to a customer before returning or searching that customer's record, allowing any agent to read and enumerate the personal information of every customer on the site, including those managed by other agents.

  3. CVE-2026-94229 5.3 Moyenne

    Unknown TrueBooker

    The TrueBooker WordPress plugin before 1.3.0 does not verify that the requester owns a booking before rendering its confirmation summary, allowing unauthenticated attackers to enumerate booking identifiers and retrieve the personal information of customers who booked an appointment, as well as invalidate the customer's own confirmation link.

  4. CVE-2026-105198 5.3 Moyenne

    Unknown Appointment Booking Plugin

    The Appointment Booking Plugin WordPress plugin before 5.7.3 does not verify that the caller owns the order referenced by an order-item identifier before rendering that order's confirmation summary, letting an unauthenticated visitor retrieve any customer's name, contact details and order confirmation code by supplying a sequential order-item id.

  5. CVE-2026-105197 2.7 Faible

    Unknown Appointment Booking Plugin

    The Appointment Booking Plugin WordPress plugin before 5.6.5 does not verify that a backend staff user is authorized to act on the specific record targeted for deletion, allowing an authenticated user with a record-scoped staff role to irreversibly delete any order, customer, or transaction on the site, including records belonging to other staff and outside their assigned scope.

  6. CVE-2026-105196 3.3 Faible

    Unknown Appointment Booking Plugin

    The Appointment Booking Plugin WordPress plugin before 5.6.9 does not enforce per-record authorization on several of its AI Abilities API actions, allowing an authenticated user holding the LatePoint Agent role, normally restricted to their own records, to read and modify other agents' profile data and read other agents' bookings and associated customer details when the Abilities API feature is enabled.