LatePoint Appointment Booking Plugin: Unauthenticated arbitrary shortcode execution

Summary

The LatePoint Appointment Booking Plugin for WordPress up to and including version 5.7.0 does not properly validate a value before it is passed to do_shortcode. An unauthenticated attacker can plant a shortcode payload through the public booking form, for example in the first or last name field, and have it executed when the customer cabinet output is rendered. Depending on the shortcodes registered on the site, the impact may reach as far as code execution, so the worst case should be assumed for exposed sites.

Affected

• LatePoint Appointment Booking Plugin for WordPress, all versions up to and including 5.7.0

Fixed in

• Version 5.7.1 contains a fix for the reported security bugs according to the WordPress.org changelog; the CVE is not named there.
• Current release per WordPress.org: 5.7.6 (includes later security fixes).
• Note: WordPress.org and the vendor changelog give different release dates for 5.7.1. Verify the installed build directly.

Workaround

• No vendor-documented interim workaround is known.
• If an update cannot be applied immediately, deactivate the plugin until it is updated.

Exploitation

• A public proof-of-concept repository is listed on Sploitus; its code was not reviewed.
• VulDB states that no exploit is available, which conflicts with the public PoC.
• No confirmed exploitation in the wild found. CISA SSVC assessment: exploitation none, automatable yes.

Our recommendation

• Inventory LatePoint versions across all client WordPress sites.
• Update to the current release (5.7.6 at time of writing), not only 5.7.1.
• If a site was exposed while on version 5.7.0 or earlier, check for unexpected booking entries or unusual content in customer names.
• Treat this as high priority for internet-facing WordPress sites.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.

• Proof of concept on GitHub (1 repositories) iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).
  murrez/CVE-2026-92966

Research sources

• Wordfence advisory (CVE reference) www.wordfence.com
• VulDB CVE-2026-92966 vuldb.com
• VulDB exploit status vuldb.com
• Lilting article on LatePoint shortcode vulnerabilities lilting.ch
• WordPress.org LatePoint plugin page wordpress.org
• LatePoint changelog latepoint.com
• WPScan LatePoint plugin wpscan.com
• Sploitus exploit entry sploitus.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 07:46.