CVE-2026-105196CWE-639

CVE-2026-105196

Low · published October 8, 2026

CVSS v3.1
3.3
EPSS
0%
Percentile
2.5
In the wild
Unconfirmed
What it is

The Appointment Booking Plugin WordPress plugin before 5.6.9 does not enforce per-record authorization on several of its AI Abilities API actions, allowing an authenticated user holding the LatePoint Agent role, normally restricted to their own records, to read and modify other agents' profile data and read other agents' bookings and associated customer details when the Abilities API feature is enabled.

The record
Technical detail
CVSS v3.1
3.3 · LOW
Vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00132 · 2.5th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-10-08T10:16Z
References (1)
https://wpscan.com/vulnerability/b7b6c989-b484-4ad6-844c-1dec1c74c34d/ · [email protected]
EPSS history
Timeline
  • 09 OCT 03:26Z
    EPSS moved — → 0%
    epss
  • 08 OCT 06:00Z
    LatePoint < 5.6.9 - Agent+ Cross-Agent Data Disclosure and Modification via Abilities API
    cvelistv5
  • 08 OCT 06:00Z
    LatePoint < 5.6.9 - Agent+ Cross-Agent Data Disclosure and Modification via Abilities API
    cvelistv5