LatePoint - Calendar Booking Plugin for Appointments and Events <= 5.4.0 - Unauthenticated Stripe PaymentIntent Amount-Binding Bypass

2026-07-07 23:37

Andrés Cruciani

Strategic Overview

Status

Patched in 5.4.1

Affected PluginLatePoint – Calendar Booking Plugin for Appointments and Events

Affected Version<= 5.4.0

CVSS7.5High

CVECVE-2026-5356

View all LatePoint – Calendar Booking Plugin for Appointments and Events vulnerabilities

Vulnerability Overview

The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Improper Input Validation in all versions up to, and including, 5.4.0. This is due to the plugin's Stripe Connect payment processor accepting a client-supplied PaymentIntent ID. This makes it possible for unauthenticated attackers to pay an arbitrary amount by supplying a previously succeeded PaymentIntent token.

Technical Analysis

REMEDIATION: Update to version 5.4.1, or a newer patched version --- IDENTIFIER: CWE-862 (Missing Authorization) The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

External References

https://www.cve.org/CVERecord?id=CVE-2026-5356 https://www.wordfence.com/threat-intel/vulnerabilities/id/1b1338c4-36a8-47b0-b3cf-c5dc690f8c1c