CVE-2026-103366 | LatePoint Appointment Booking Plugin up to 5.7.3 on WordPress set_required_objects booking[id]/cart[id] authorization

October 14, 2026 Yanac

A vulnerability, which was classified as problematic, was found in LatePoint Appointment Booking Plugin up to 5.7.3 on WordPress. Affected by this issue is the function OsStepsHelper::set_required_objects. The manipulation of the argument booking[id]/cart[id] results in authorization bypass.

This vulnerability is reported as CVE-2026-103366. The attack can be launched remotely. No exploit exists.VulDB Recent EntriesRead More