Skip to content
Threat Feed
Subscribe

Product

LatePoint – Calendar Booking Plugin for Appointments and Events (<= 5.4.0)

1 brief RSS
high advisory

CVE-2026-5356: LatePoint WordPress Plugin Improper Input Validation Leading to Arbitrary Payments

An improper input validation vulnerability (CVE-2026-5356) in the LatePoint - Calendar Booking Plugin for Appointments and Events for WordPress, versions up to and including 5.4.0, allows unauthenticated attackers to exploit its Stripe Connect payment processor by supplying a previously succeeded PaymentIntent ID, resulting in the processing of arbitrary payments.

LatePoint – Calendar Booking Plugin for Appointments and Events wordpress plugin vulnerability webserver cve
2t 1c