151 lines
6.9 KiB
JSON
151 lines
6.9 KiB
JSON
{
|
||
"dataType": "CVE_RECORD",
|
||
"dataVersion": "5.2",
|
||
"cveMetadata": {
|
||
"cveId": "CVE-2026-5234",
|
||
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
|
||
"state": "PUBLISHED",
|
||
"assignerShortName": "Wordfence",
|
||
"dateReserved": "2026-03-31T14:05:18.117Z",
|
||
"datePublished": "2026-04-17T03:36:44.618Z",
|
||
"dateUpdated": "2026-04-17T18:38:40.183Z"
|
||
},
|
||
"containers": {
|
||
"cna": {
|
||
"providerMetadata": {
|
||
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
|
||
"shortName": "Wordfence",
|
||
"dateUpdated": "2026-04-17T03:36:44.618Z"
|
||
},
|
||
"affected": [
|
||
{
|
||
"vendor": "latepoint",
|
||
"product": "LatePoint – Calendar Booking Plugin for Appointments and Events",
|
||
"versions": [
|
||
{
|
||
"version": "0",
|
||
"status": "affected",
|
||
"lessThanOrEqual": "5.3.2",
|
||
"versionType": "semver"
|
||
}
|
||
],
|
||
"defaultStatus": "unaffected"
|
||
}
|
||
],
|
||
"descriptions": [
|
||
{
|
||
"lang": "en",
|
||
"value": "The LatePoint plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.3.2. The vulnerability exists because the OsStripeConnectController::create_payment_intent_for_transaction action is registered as a public action (no authentication required) and loads invoices by sequential integer invoice_id without any access_key or ownership verification. This is in contrast to other invoice-related actions (view_by_key, payment_form, summary_before_payment) in OsInvoicesController which properly require a cryptographic UUID access_key. This makes it possible for unauthenticated attackers to enumerate valid invoice IDs via an error message oracle, create unauthorized transaction intent records in the database containing sensitive financial data (invoice_id, order_id, customer_id, charge_amount), and on sites with Stripe Connect configured, the response also leaks Stripe payment_intent_client_secret tokens, transaction_intent_key values, and payment amounts for any invoice."
|
||
}
|
||
],
|
||
"title": "LatePoint <= 5.3.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Financial Data Exposure via Sequential Invoice ID",
|
||
"references": [
|
||
{
|
||
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/afec4c8c-a18d-4907-8879-2412f8a1abed?source=cve"
|
||
},
|
||
{
|
||
"url": "https://plugins.trac.wordpress.org/browser/latepoint/trunk/lib/controllers/stripe_connect_controller.php#L31"
|
||
},
|
||
{
|
||
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.2.9/lib/controllers/stripe_connect_controller.php#L31"
|
||
},
|
||
{
|
||
"url": "https://plugins.trac.wordpress.org/browser/latepoint/trunk/lib/controllers/stripe_connect_controller.php#L33"
|
||
},
|
||
{
|
||
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.2.9/lib/controllers/stripe_connect_controller.php#L33"
|
||
},
|
||
{
|
||
"url": "https://plugins.trac.wordpress.org/browser/latepoint/trunk/lib/controllers/stripe_connect_controller.php#L50"
|
||
},
|
||
{
|
||
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.2.9/lib/controllers/stripe_connect_controller.php#L50"
|
||
},
|
||
{
|
||
"url": "https://plugins.trac.wordpress.org/browser/latepoint/trunk/lib/controllers/stripe_connect_controller.php#L20"
|
||
},
|
||
{
|
||
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.2.9/lib/controllers/stripe_connect_controller.php#L20"
|
||
},
|
||
{
|
||
"url": "https://plugins.trac.wordpress.org/changeset/3505127/latepoint/trunk/lib/controllers/stripe_connect_controller.php"
|
||
}
|
||
],
|
||
"problemTypes": [
|
||
{
|
||
"descriptions": [
|
||
{
|
||
"lang": "en",
|
||
"description": "CWE-639 Authorization Bypass Through User-Controlled Key",
|
||
"cweId": "CWE-639",
|
||
"type": "CWE"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"metrics": [
|
||
{
|
||
"cvssV3_1": {
|
||
"version": "3.1",
|
||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
|
||
"baseScore": 5.3,
|
||
"baseSeverity": "MEDIUM"
|
||
}
|
||
}
|
||
],
|
||
"credits": [
|
||
{
|
||
"lang": "en",
|
||
"type": "finder",
|
||
"value": "darkestmode"
|
||
}
|
||
],
|
||
"timeline": [
|
||
{
|
||
"time": "2026-03-31T14:20:32.000Z",
|
||
"lang": "en",
|
||
"value": "Vendor Notified"
|
||
},
|
||
{
|
||
"time": "2026-04-16T15:19:09.000Z",
|
||
"lang": "en",
|
||
"value": "Disclosed"
|
||
}
|
||
]
|
||
},
|
||
"adp": [
|
||
{
|
||
"metrics": [
|
||
{
|
||
"other": {
|
||
"type": "ssvc",
|
||
"content": {
|
||
"timestamp": "2026-04-17T18:38:28.386411Z",
|
||
"id": "CVE-2026-5234",
|
||
"options": [
|
||
{
|
||
"Exploitation": "none"
|
||
},
|
||
{
|
||
"Automatable": "no"
|
||
},
|
||
{
|
||
"Technical Impact": "partial"
|
||
}
|
||
],
|
||
"role": "CISA Coordinator",
|
||
"version": "2.0.3"
|
||
}
|
||
}
|
||
}
|
||
],
|
||
"title": "CISA ADP Vulnrichment",
|
||
"providerMetadata": {
|
||
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||
"shortName": "CISA-ADP",
|
||
"dateUpdated": "2026-04-17T18:38:40.183Z"
|
||
}
|
||
}
|
||
]
|
||
}
|
||
} |