PT-2026-104140

Name of the Vulnerable Software and Affected Versions LatePoint | Calendar & Scheduling for WordPress versions prior to 5.7.2 Description An Insecure Direct Object Reference exists via the OsPaypalConnectController::create order for transaction action, which is registered as a public route throug...

WordPress Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin <= 5.7.1 - Insecure Direct Object Reference to Unauthenticated Unauthorized Transaction Intent Creation/Modification and Invoice Enumeration vulnerability

Insecure Direct Object Reference to Unauthenticated Unauthorized Transaction Intent Creation/Modification and Invoice Enumeration vulnerability discovered by Niv Kochan, Matan Bachar in WordPress Plugin LatePoint versions = 5.7.1...