---
id: CVE-2026-105257
title: LatePoint < 5.7.5 - Agent+ Customer PII Disclosure via IDOR
summary: >-
  The Appointment Booking Plugin  WordPress plugin before 5.7.5 does not verify
  that an authenticated agent-level user is assigned to a customer before
  returning or searching that customer's record, allowing any agent to read and
  enumerate…
severity: none
cwe:
  - CWE-639
product: Appointment Booking Plugin
affected:
  - appointment_booking_plugin < 5.7.5
published: '2026-10-21'
updated: '2026-10-21'
sourceUpdated: '2026-10-21T06:00:18.196Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-105257'
references:
  - url: 'https://wpscan.com/vulnerability/10a8f09f-8282-456d-ad07-7e594e70a371/'
tags:
  - cve.org
ingestedAt: '2026-10-21T06:42:48.187Z'
---

## Overview

The Appointment Booking Plugin  WordPress plugin before 5.7.5 does not verify that an authenticated agent-level user is assigned to a customer before returning or searching that customer's record, allowing any agent to read and enumerate the personal information of every customer on the site, including those managed by other agents.

## Affected

- `appointment_booking_plugin < 5.7.5`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.