---
id: CVE-2026-105257
title: LatePoint < 5.7.5 - Agent+ Customer PII Disclosure via IDOR
summary: >-
  The Appointment Booking Plugin  WordPress plugin before 5.7.5 does not verify
  that an authenticated agent-level user is assigned to a customer before
  returning or searching that customer's record, allowing any agent to read and
  enumerate…
severity: low
cvss: 2.7
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N'
cvssSource: adp
cwe:
  - CWE-639
product: Appointment Booking Plugin
affected:
  - appointment_booking_plugin < 5.7.5
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-21T10:24:02.743042Z'
published: '2026-10-21'
updated: '2026-10-21'
sourceUpdated: '2026-10-21T10:35:09.010Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-105257'
references:
  - url: 'https://wpscan.com/vulnerability/10a8f09f-8282-456d-ad07-7e594e70a371/'
tags:
  - cve.org
ingestedAt: '2026-10-21T06:42:48.187Z'
epss: 0.00289
epssPercentile: 0.21313
---

## Overview

The Appointment Booking Plugin  WordPress plugin before 5.7.5 does not verify that an authenticated agent-level user is assigned to a customer before returning or searching that customer's record, allowing any agent to read and enumerate the personal information of every customer on the site, including those managed by other agents.

## Affected

- `appointment_booking_plugin < 5.7.5`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.