CVE-2026-96662

Summary

The LatePoint WordPress plugin contains a SQL injection vulnerability in the booking[service_id] parameter that allows unauthenticated attackers to inject malicious SQL queries and extract sensitive database information. This represents a significant security risk as it can lead to data exposure without requiring any authentication.

Exploitability

Exploitation is relatively straightforward as attackers need only send a specially crafted request to the booking endpoint with a malicious service_id parameter, with no authentication required.

Blast radius

If exploited, this vulnerability could expose sensitive customer booking data, user information, and potentially other database contents to unauthenticated attackers across all affected WordPress installations.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to version 5.7.3 or later which contains the SQL injection fix for the booking[service_id] parameter.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.