{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-111602",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-18T11:09:30.558764Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-18T11:22:47.696Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Appointment Booking Plugin \u2013 LatePoint | Calendar \u0026 Scheduling for WordPress",
          "vendor": "latepoint",
          "versions": [
            {
              "lessThanOrEqual": "5.7.4",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Ji\u0159\u00ed Fryjauf (jfryjauf)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Appointment Booking Plugin \u2013 LatePoint | Calendar \u0026 Scheduling for WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.7.4 via the \u0027params (customer[uuid])\u0027 parameter. This makes it possible for unauthenticated attackers to extract the first name, last name, email address, phone number, and notes of every customer record in the database by enumerating uuid prefixes via the unauthenticated steps__load_step AJAX endpoint. This vulnerability is only exploitable when the LatePoint plugin is configured with the \u0027Field used for authentication\u0027 setting set to \u0027Disable ability to login\u0027 (guest checkout mode)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-17T02:31:07.048Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6afce24f-30cd-4aeb-a5dd-20bd80a75779?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.4/lib/helpers/steps_helper.php#L1175"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.4/lib/controllers/steps_controller.php#L355"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.4/lib/models/model.php#L379"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.4/lib/helpers/params_helper.php#L14"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.5/lib/controllers/steps_controller.php"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-08T22:13:58.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-10-16T14:30:46.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Appointment Booking Plugin \u003c= 5.7.4 - Unauthenticated Sensitive Information Disclosure via ORM Operator Injection in \u0027customer[uuid]\u0027 Parameter"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-111602",
    "datePublished": "2026-10-17T02:31:07.048Z",
    "dateReserved": "2026-10-16T14:30:12.558Z",
    "dateUpdated": "2026-10-18T11:22:47.696Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-111602\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-10-18T11:09:30.558764Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-10-18T11:16:07.437Z\"}}], \"cna\": {\"title\": \"Appointment Booking Plugin \u003c= 5.7.4 - Unauthenticated Sensitive Information Disclosure via ORM Operator Injection in \u0027customer[uuid]\u0027 Parameter\", \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Ji\\u0159\\u00ed Fryjauf (jfryjauf)\"}], \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 3.7, \"baseSeverity\": \"LOW\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N\"}}], \"affected\": [{\"vendor\": \"latepoint\", \"product\": \"Appointment Booking Plugin \\u2013 LatePoint | Calendar \u0026 Scheduling for WordPress\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.7.4\"}], \"defaultStatus\": \"unaffected\"}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2026-10-08T22:13:58.000Z\", \"value\": \"Vendor Notified\"}, {\"lang\": \"en\", \"time\": \"2026-10-16T14:30:46.000Z\", \"value\": \"Disclosed\"}], \"references\": [{\"url\": \"https://www.wordfence.com/threat-intel/vulnerabilities/id/6afce24f-30cd-4aeb-a5dd-20bd80a75779?source=cve\"}, {\"url\": \"https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.4/lib/helpers/steps_helper.php#L1175\"}, {\"url\": \"https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.4/lib/controllers/steps_controller.php#L355\"}, {\"url\": \"https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.4/lib/models/model.php#L379\"}, {\"url\": \"https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.4/lib/helpers/params_helper.php#L14\"}, {\"url\": \"https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.5/lib/controllers/steps_controller.php\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"The Appointment Booking Plugin \\u2013 LatePoint | Calendar \u0026 Scheduling for WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.7.4 via the \u0027params (customer[uuid])\u0027 parameter. This makes it possible for unauthenticated attackers to extract the first name, last name, email address, phone number, and notes of every customer record in the database by enumerating uuid prefixes via the unauthenticated steps__load_step AJAX endpoint. This vulnerability is only exploitable when the LatePoint plugin is configured with the \u0027Field used for authentication\u0027 setting set to \u0027Disable ability to login\u0027 (guest checkout mode).\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-200\", \"description\": \"CWE-200 Exposure of Sensitive Information to an Unauthorized Actor\"}]}], \"providerMetadata\": {\"orgId\": \"b15e7b5b-3da4-40ae-a43c-f7aa60e62599\", \"shortName\": \"Wordfence\", \"dateUpdated\": \"2026-10-17T02:31:07.048Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-111602\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-10-18T11:22:47.696Z\", \"dateReserved\": \"2026-10-16T14:30:12.558Z\", \"assignerOrgId\": \"b15e7b5b-3da4-40ae-a43c-f7aa60e62599\", \"datePublished\": \"2026-10-17T02:31:07.048Z\", \"assignerShortName\": \"Wordfence\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}