Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Improper Input Validation in all versions up to, and including, 5.4.0. This is due to the plugin's Stripe Connect payment processor accepting a client-supplied PaymentIntent ID. This makes it possible for unauthenticated attackers to pay an arbitrary amount by supplying a previously succeeded PaymentIntent token.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
🚨 HIGH SEVERITY: CVE-2026-5356 (CVSS 7.5) LatePoint WordPress plugin vulnerable to payment bypass. Unauthenticated attackers can reuse PaymentIntent tokens to pay arbitrary amounts. Affects: All versions ≤ 5.4.0 Patch immediately. #CVE #Vulnerability #PatchNow https://t.co/YYYjzajG9m
Post summary
High‑severity CVE-2026-5356 allows unauthenticated payment bypass in the LatePoint WordPress plugin; immediate patching is urged.
#CVE-2026-5356 - #LatePoint plugin payment bypass via #Stripe Connect. #CVSS 7.5. Improper input validation allows unauthenticated attackers to pay arbitrary amounts. Update immediately if using version <= 5.4.0. #CVEAlert #devops #devsecops #developers #WordPress #infosec https://www.valtersit.com/cve/CVE-2026-5356
Post summary
CVE-2026-5356 permits unauthenticated Stripe Connect payment bypass due to improper input validation; users on LatePoint plugin versions <= 5.4.0 are advised to update immediately.