CVE-2026-11866 — LatePoint < 5.6.3 - Multiple Privileged Actions via CSRF

CVE-2026-11866

LatePoint < 5.6.3 - Multiple Privileged Actions via CSRF PUBLISHED

Description (CNA)

The Appointment Booking Plugin WordPress plugin before 5.6.3 does not validate a CSRF nonce on several state-changing actions handled by its central request dispatcher, allowing attackers to perform privileged actions, such as overwriting the booking-form configuration or disconnecting the connected payment gateway, via Cross-Site Request Forgery against a logged-in administrator.

Affected (CNA)

Vendor / product	Versions
Unknown / Appointment Booking Plugin	affected 0 before 5.6.3

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/84e936b8-1978-4dc3-aa40-5ce49bfdc445/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.