Exploit discussion active in current signal (1 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.6.0. This is due to missing or incorrect nonce validation on the change_status function. This makes it possible for unauthenticated attackers to change the status of arbitrary invoices — including marking unpaid invoices as paid — without administrator consent via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-06-07 | 2 | Disclosure2 |
| 2026-06-13 | 1 | PoC1 |
https://atomicedge.io/cve-proof/cve-2026-9719-latepoint-version-5-6-0-medium-vulnerability-proof-of-concept CVE-2026-9719 latepoint (CVSS Score 4.3) #WordPress plugin #vulnerability #cybersecurity #wordpressfirewall #wordpresssecurity #hacking #wpsecurity #atomicedge #cybersec…
Post summary
The post provides a link to a proof‑of‑concept for CVE‑2026‑9719, specifying the vulnerability details but not offering exploit code or patches.
🚨*CVE* CVE-2026-9719 The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and includin… https://www.cve.org/CVERecord?id=CVE-2026-9719 ----- Traducción: CVE-2026-9719 The… http://infoflow.cloud`
Post summary
A new CVE-2026-9719 is disclosed, reporting a Cross‑Site Request Forgery vulnerability in the LatePoint WordPress plugin; no exploit, patch, or evidence of active exploitation is referenced.
CVE-2026-9719 The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and includin… https://www.cve.org/CVERecord?id=CVE-2026-9719
Post summary
The post reports that CVE‑2026‑9719 introduces a CSRF flaw in all earlier versions of the LatePoint WordPress plugin, with no Proof of Concept, exploit, or mitigation details provided.