CVE-2026-111602

Executive Summary

CVE-2026-111602 is a Sensitive Information Exposure (CWE-200) vulnerability in the WordPress plugin "Appointment Booking Plugin – LatePoint | Calendar & Scheduling" affecting all versions up to and including 5.7.4. When the plugin's "Field used for authentication" setting is configured to "Disable ability to login" (guest checkout mode), an unauthenticated attacker can enumerate customers by UUID prefix through the steps__load_step AJAX endpoint, extracting first name, last name, email address, phone number, and booking notes. The CVSS v3.1 score of 3.7 reflects high attack complexity and confidentiality-only impact, but the exposure of complete customer contact records enables targeted phishing, social engineering, and privacy/regulatory harm.

Technical Analysis

LatePoint is a commercial WordPress appointment-booking and scheduling plugin. The reported issue is a user/record enumeration flaw exposed through an AJAX action named steps__load_step. According to the NVD description, the plugin accepts a parameter identified as params (customer[uuid]) — i.e., a nested customer object whose uuid sub-key is supplied by the client. When the plugin setting "Field used for authentication" is set to "Disable ability to login" (guest checkout / unauthenticated booking mode), the step-loading handler does not require an authenticated session or nonce-bound authorization check before returning customer data associated with a looked-up UUID.

Because the underlying customer identifier is a UUID rather than a monotonic integer, the endpoint is not trivially enumerable by counting upward. The vulnerability nevertheless permits systematic extraction via UUID prefix probing: an attacker submits a given customer[uuid] value and observes whether the request resolves to a record. In a vulnerable configuration the response path returns sensitive attributes for the matched record — first name, last name, email address, phone number, and booking notes.

The CVSS vector (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) is consistent with this description: remotely reachable, requires no authentication or user interaction, exploits only a single component, and impacts only confidentiality (low). The "AC:H" (high attack complexity) reflects the fact that exploitation depends on both the non-default guest-checkout setting and the difficulty of guessing/deriving the target UUID prefix.

Key attack-surface elements (all drawn from the description):

• Transport: unauthenticated HTTP(S) AJAX requests to WordPress's admin-ajax mechanism, invoking the steps__load_step action.
• Input of interest: nested parameter customer[uuid].
• Configuration precondition: "Field used for authentication" = "Disable ability to login" (guest checkout mode).
• Output revealed: first name, last name, email, phone number, notes.

No function-level or file-path details are provided in the source data; the above should be treated as a description of the vulnerability class (unauthenticated object reference / enumeration leading to PII exposure) anchored to the endpoint and parameter names explicitly named in the advisory.

Exploitation Scenarios

No public PoC or exploit code is available; the attack chain below is inferred from the vulnerability class and the endpoint/parameter names in the advisory.

1. Reconnaissance / target identification. Attackers enumerate WordPress sites running LatePoint (identifiable via page assets, booking flows, or the plugin's presence). They prioritize sites that expose guest booking without login — the vulnerable mode. Public Shodan/FOFA searches for LatePoint booking pages narrow the target list.

2. Triggering the flaw. The attacker issues unauthenticated POST requests to the WordPress admin-ajax endpoint with action=steps__load_step and a nested parameter customer[uuid] set to a candidate value. Because the handler honors the guest-checkout configuration, no session or valid nonce is required.

3. Payload/execution at the class level. The attacker systematically varies the UUID value (prefix probing / guessing) and inspects responses. Each response that resolves to a record discloses first name, last name, email address, phone number, and notes. Iterating the process builds a dataset even though the identifier space is large — accuracy is achieved by observing which prefixes resolve.

4. Post-exploitation impact. Harvested PII (emails, phone numbers, names, appointment notes) supports highly targeted phishing, smishing/vishing, account-takeover pretexting, and sale of customer lists. Booking notes may contain additional sensitive operational or personal details. Out-of-band, the same data enables GDPR/CCPA exposure, breach-notification obligations, and reputational damage to the booking business.

Impact Assessment

Business impact centers on confidentiality of customer data. Affected parties are WordPress sites running LatePoint ≤ 5.7.4 configured in guest-checkout mode ("Disable ability to login"); sites requiring login-based authentication are not exploitable as described. The blast radius includes every customer record reachable in the site's booking database, since the flaw is unauthenticated and requires no user interaction.

CVSS subscores explain the low overall severity: Confidentiality is rated Low (limited per-request leakage, compounded by UUID guessing complexity — AC:H), with no Integrity or Availability impact (I:N/A:N), scope unchanged (S:U). Practical risk is elevated by the sensitivity of the exposed fields: persistent email and phone data turn a "low" confidentiality score into a meaningful phishing and privacy-compliance problem. No EPSS score is available, no CISA KEV listing exists, and there is no reported in-the-wild exploitation, so prioritization should follow PII exposure and regulatory obligations rather than active-threat signals.

Detection Guidance

Sigma Rule

title: LatePoint Customer UUID Enumeration via steps__load_step AJAX
id: 8f2c9a1e-lp-2026-111602
status: experimental
description: Detects unauthenticated enumeration of customer UUIDs against LatePoint steps__load_step AJAX action
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-111602
author: valtersit.com threat intelligence
date: 2026/01/01
logsource:
  category: webserver
detection:
  selection_uri:
    cs-uri-query|contains:
      - 'action=steps__load_step'
  selection_param:
    cs-uri-query|contains: 'customer%5Buuid%5D'
  condition: selection_uri and selection_param
fields:
  - c-ip
  - cs-uri-query
  - sc-status
falsepositives:
  - Legitimate guest checkout sessions during normal booking flow
level: low

YARA Rule

rule CVE_2026_111602_LatePoint_Info_Exposure
{
    meta:
        description = "Detects requests referencing LatePoint steps__load_step and customer uuid parameters"
        cve = "CVE-2026-111602"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-111602"
        author = "valtersit.com threat intelligence"
    strings:
        $a = "steps__load_step" ascii wide nocase
        $b = "customer[uuid]" ascii wide nocase
        $c = "customer%5Buuid%5D" ascii wide nocase
    condition:
        $a and ($b or $c)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-111602 LatePoint customer UUID enumeration via steps__load_step"; flow:to_server,established; http.uri; content:"action=steps__load_step"; http.uri; content:"uuid"; nocase; reference:cve,2026-111602; classtype:attempted-recon; sid:1026001; rev:1;)

Elastic Detection

network where
  url.query : ("*action=steps__load_step*" and "*uuid*") and
  http.request.method == "POST"

Splunk SPL Query

index=web_logs
| eval lq=lower(cs_uri_query)
| eval target_q=lq
| where (like(lq,"%action=steps__load_step%") AND (like(lq,"%customer[uuid]%") OR like(lq,"%customer%5Buuid%5D%")))
| stats count values(c_ip) as sources by cs_uri_query, c_ip
| where count > 5
| sort - count

Wazuh OSSEC Rule

<group name="web,wordpress,latepoint,">
  <rule id="100602" level="6">
    <decoded_as>web-accesslog</decoded_as>
    <url>action=steps__load_step</url>
    <regex>uuid</regex>
    <description>CVE-2026-111602: Possible LatePoint customer UUID enumeration via steps__load_step AJAX endpoint</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>attempted_recon,pii_exposure,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). Treat the plugin as unpatched in its current state and do not assume an official fix is available.

1. Immediate mitigations

• Change the LatePoint "Field used for authentication" setting away from "Disable ability to login" (guest checkout mode) so that the endpoint is not operative in the vulnerable configuration.
• Where guest checkout must remain, place the booking flow behind a WAF rule that blocks or rate-limits requests to action=steps__load_step carrying client-controlled customer[uuid] values, and cap enumeration attempts per source IP.
• Restrict exposure of WordPress AJAX handlers to authenticated sessions via edge/WAF policy; monitor for anomalous UUID probing volume.
• Treat all stored customer PII (emails, phone numbers, names, notes) as potentially exposed if the site ran in guest mode and consider breach-assessment/precautionary notification review.

2. Patch/upgrade steps

• No fixed version is identified in tracked sources. Contact the plugin vendor (LatePoint) for a security status statement and monitor the WordPress.org plugin changelog and vendor advisory for a version beyond 5.7.4.
• Stage any vendor fix in a non-production copy, verify the setting-dependent exposure is closed, then deploy.

3. Long-term hardening

• Enforce server-side authorization checks on any handler returning customer objects; never rely on secrecy of UUIDs for access control.
• Adopt UUIDv4 random identifiers (never truncatable/guessable prefixes) for customer references.
• Minimize data returned in AJAX step responses to fields immediately required for the current step.
• Maintain a plugin inventory with vulnerability monitoring and a WAF baseline for WordPress AJAX enumeration patterns.

References

• NVD entry for CVE-2026-111602: https://nvd.nist.gov/vuln/detail/CVE-2026-111602
• CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor): https://cwe.mitre.org/data/definitions/200.html
• MITRE ATT&CK T1190 (Exploit Public-Facing Application): https://attack.mitre.org/techniques/T1190/
• LatePoint plugin page (WordPress.org) for version/changelog monitoring: https://wordpress.org/plugins/latepoint/
• FIRST EPSS project (no score recorded for this CVE as of writing): https://www.first.org/epss/

No public PoC, exploit code, or Nuclei template was identified; there is no CISA KEV listing and no known threat-actor campaign associated with this CVE at the time of writing.