CVE-2026-13471

The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.6.3 via the LatePointAbilityDeleteBooking::execute due to missing validation on a user controlled key. This makes it...

CVE-2026-13471

The LatePoint – Calendar Booking Plugin for Appointments and Events (WordPress) is affected by an Insecure Direct Object Reference (IDOR) in all versions up to and including 5.6.3 . The vulnerability resides in the Abilities REST API (specifically LatePointAbilityDeleteBooking::execute, list-book...

EUVD-2026-82750

The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.6.3 via the LatePointAbilityDeleteBooking::execute due to missing validation on a user controlled key. This makes it...