CVSS 3.1
5.3 mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NCVE-2026-1537
Medium (5.3). EPSS 0.3% chance of exploitation in the next 30 days.
The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the load_step() function in all versions up to, and including, 5.2.6. This makes it possible for unauthenticated attackers to view booking information including customer names, email addresses, phone numbers, appointment times, and service details.
Severity
- EPSS
- 0.3% chance of exploitation in the next 30 days; higher than 20% of CVEs (scores of 2026-10-31)
- CWE
- CWE-862
- Published
- Modified
- Record from
- the NVD, synced