{"id":"CVE-2026-105256","published":"2026-10-21T09:17:06.197","lastModified":"2026-10-21T18:37:38.700","description":"The LatePoint WordPress plugin before 5.7.5 does not validate the client-supplied value that determines how much is charged for a booking against the amounts the service and site actually allow, allowing an unauthenticated visitor to make the amount due resolve to zero and obtain a confirmed appointment and a recorded order without completing any payment.","cvssScore":5.3,"cvssSeverity":"MEDIUM","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","cwes":["CWE-345"],"vendors":[],"products":[],"references":[{"url":"https://wpscan.com/vulnerability/53a81b39-e86b-4b73-8b4f-64746684055d/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}