LatePoint – Calendar Booking Plugin for Appointments and Events <= 5.2.7 - 予約フォーム設定の更新におけるクロスサイトリクエストフォージェリ (Cross-Site Request Forgery) と、保存されたクロスサイトスクリプティング (Stored Cross-Site Scripting)

Successful exploitation of CVE-2026-2324 could allow an attacker to execute arbitrary JavaScript code within the context of a user's browser, specifically targeting site administrators. This could lead to account takeover, data theft (including sensitive appointment details and user information), and defacement of the WordPress site. The attack relies on tricking an administrator into clicking a malicious link, making social engineering a key component. While the vulnerability requires administrator interaction, the potential impact is significant, as it could compromise the entire WordPress site and its associated data.

WordPress websites utilizing the LatePoint – Calendar Booking Plugin, particularly those with administrator accounts that are not adequately trained in security best practices, are at risk. Shared hosting environments where multiple websites share the same server resources are also at increased risk, as a compromise of one site could potentially lead to lateral movement to others.

• wordpress / composer / npm:

grep -r "reload_preview()" /var/www/html/wp-content/plugins/latepoint-booking-plugin-for-appointments-and-events/

• wordpress / composer / npm:

wp plugin list --status=inactive | grep latepoint

• wordpress / composer / npm:

wp plugin update latepoint-booking-plugin-for-appointments-and-events

1. 2026-03-11Disclosure

   disclosure

1. 予約済み2026-02-10
2. 公開日2026-03-11
3. 更新日2026-04-08
4. EPSS 更新日2026-03-23

The primary mitigation for CVE-2026-2324 is to immediately upgrade the LatePoint – Calendar Booking Plugin to version 5.2.8 or later. If upgrading is not immediately feasible, consider implementing stricter input validation and output encoding on all user-supplied data within the plugin. Web Application Firewalls (WAFs) configured to detect and block XSS payloads can provide an additional layer of defense. Monitor WordPress logs for suspicious activity, particularly requests targeting the reload_preview() function. After upgrading, confirm the fix by attempting to trigger the vulnerable function with a known malicious payload and verifying that it is properly sanitized.