---
title: "Booking Plugin Vulnerabilities: 45% Are Authorization Bugs"
slug: "booking-plugin-vulnerabilities"
description: "Booking plugin vulnerabilities skew toward missing authorization and IDOR. See which plugins lead the count, what LatePoint fixed in four releases, and what to check."
date: 2026-10-11
author: "WP Vanguard Team"
category: "Research"
tags: ["booking-plugin-vulnerabilities", "wordpress-booking-plugins", "latepoint", "idor", "vulnerability-trends"]
featured_image: "/images/blog/booking-plugin-vulnerabilities.jpg"
palette: "edu"
---

From July 13 to October 11, 2026, our database logged 196 vulnerabilities in WordPress booking and appointment plugins. Eighty-nine of them, 45%, are authorization bugs: a missing permission check, or an insecure direct object reference (IDOR) where a request asks for record 42 and the plugin hands it over without asking whose record it is.

```stat
{"value": "45% vs 25%", "label": "share of booking plugin disclosures that are authorization or IDOR bugs, against all plugins", "note": "196 booking disclosures in 57 plugins, against 3,857 across all plugins. July 13 to October 11, 2026."}
```

That gap is the story. Across every plugin in the same window, authorization and IDOR bugs make up about a quarter of disclosures. Booking plugins run nearly twice that. The reason is built into what they do: a customer has to manage their own appointment without a WordPress account, so the plugin invents its own login out of IDs and tokens, and every endpoint then has to check ownership by hand.

## How We Counted Booking Plugin Vulnerabilities

We matched plugin slugs that contain book, appoint, schedul or reserv, plus a few named plugins such as LatePoint, Amelia, Salon Booking System and Tourfic. Then we removed the false matches: flipbooks, ebooks, bookmark tools and social-sharing plugins. That leaves 57 plugins.

Unlike our [form plugin count](/blog/form-builder-plugin-vulnerabilities), this one includes every severity, not only critical and high. Authorization bugs often score as medium because they leak data instead of running code, and a high-only filter would hide most of them. We classified each record by the wording of its title, so a bug described as "Missing Authorization to Unauthenticated Information Exposure" counts once, as authorization.

The sitewide comparison uses the same 90 days and all 3,857 plugin disclosures in that window. The live list is on our [vulnerabilities page](/vulnerabilities).

## Why Booking Plugins Fail on Authorization

The booking flow is public by design. A visitor picks a service, enters a name and email, and gets a confirmation link. Weeks later they open that link to reschedule or cancel. WordPress has no concept of that visitor, so the plugin issues its own identifiers: customer IDs, booking IDs, invoice IDs, public tokens.

Each of those identifiers travels in a request. Each endpoint that accepts one has to decide whether the caller is allowed to see or change that record. Miss the check on one endpoint and a stranger can read someone else's appointment, which usually includes a name, an email address and a phone number.

```bars
{"title": "Share of disclosures by bug class", "highlight": "Authz, booking", "data": [
 {"label": "Authz, booking", "value": 45, "display": "45%"},
 {"label": "Authz, all", "value": 25, "display": "25%"},
 {"label": "XSS, booking", "value": 16, "display": "16%"},
 {"label": "XSS, all", "value": 30, "display": "30%"},
 {"label": "SQLi, booking", "value": 11, "display": "11%"},
 {"label": "SQLi, all", "value": 10, "display": "10%"}
], "note": "Authz = missing or incorrect authorization plus IDOR. All severities, July 13 to October 11, 2026."}
```

The other columns are worth a look too. Cross-site scripting, the biggest class sitewide at 30%, is only 16% here. Booking plugins collect less free text that an administrator reads later, so there's less to inject into. SQL injection sits at about the sitewide rate.

> [!KEY]
> Booking plugins are not more buggy overall. They fail in a different place: object ownership, the check that a record belongs to the person asking for it.

## The Plugins With the Most Disclosures

These are the booking plugins with the most disclosures in the window, all severities.

| Plugin | Disclosures | Critical or high | Active installs |
|---|---|---|---|
| [Bookly](/vulnerabilities/plugin/bookly-responsive-appointment-booking-tool) | 20 | 9 | 60,000+ |
| [Amelia](/vulnerabilities/plugin/ameliabooking) | 16 | 2 | 90,000+ |
| [Easy Appointments](/vulnerabilities/plugin/easy-appointments) | 13 | 2 | 10,000+ |
| [Simply Schedule Appointments](/vulnerabilities/plugin/simply-schedule-appointments) | 13 | 4 | 50,000+ |
| [LatePoint](/vulnerabilities/plugin/latepoint) | 12 | 3 | 100,000+ |
| [Booking Calendar](/vulnerabilities/plugin/booking) | 9 | 2 | 40,000+ |
| [Salon Booking System](/vulnerabilities/plugin/salon-booking-system) | 9 | 2 | 2,000+ |

TrueBooker had 14 disclosures, 10 of them critical or high, but it's sold outside the WordPress directory, so there's no install count to put next to it. We covered one of its bugs in [TrueBooker's arbitrary password reset](/blog/truebooker-arbitrary-password-reset-cve-2026-14364).

Install count again explains the order better than quality does. The three plugins with the most disclosures also have tens of thousands of installs, and researchers go where the installs are. We saw the same thing in our look at [new plugins and their vulnerabilities](/blog/new-wordpress-plugins-installs-and-vulnerabilities).

## LatePoint: Four Releases in 19 Days

LatePoint (100,000 installs) is the clearest example of how this plays out. Version 5.7.0 shipped on September 16. Four releases followed by October 5, and three of them carry fixes we checked in a test install.

```timeline
{"title": "LatePoint security releases", "data": [
 {"label": "Sep 16", "sub": "5.7.0", "text": "Last version with the shortcode bug"},
 {"label": "Sep 22", "sub": "5.7.1", "text": "Shortcode brackets encoded in output"},
 {"label": "Sep 29", "sub": "5.7.3", "text": "Query builder and ownership fixes"},
 {"label": "Oct 5", "sub": "5.7.4", "text": "Default customer role locked down"}
]}
```

**5.7.1 (CVE-2026-92966).** A customer's first or last name could contain a shortcode in square brackets, and the customer dashboard printed that name back with the brackets intact. Any later pass over the page that runs shortcodes, such as a page builder or a nested content filter, would execute it. The fix encodes the brackets before the output leaves the plugin.

**5.7.3 (CVE-2026-96662).** The plugin's query builder joined array keys from a request straight into the SQL string. A key that wasn't `AND` or `OR` ended up in the query. The fix skips any key that isn't one of those two, and drops array values from fields that should only ever hold a single number. The same release added a check that a bundle order belongs to the logged-in customer, which closes an IDOR, and stopped matching customers to WordPress accounts by username.

**5.7.4 (CVE-2026-104766).** The setting that picks the WordPress role for new customers accepted any role, including administrator, from a user with a custom LatePoint role. The fix forces the value back to the customer role if the chosen role can manage options or promote users.

All three fixes shipped before the CVE was public: 8 days before for the shortcode bug, 10 days for the SQL injection, and 4 days for the role setting. LatePoint's vendor did the work early. The release pace tells you how much was in the code, not how careless anyone was.

## What We Checked in a Test Install

We read the patches for every plugin above and ran the three LatePoint fixes plus Booking Activities in a throwaway container: WordPress 7.1.2 on PHP 8.3, with a harmless marker class and a harmless marker shortcode in place of anything dangerous. The results held up.

| Check | Vulnerable version | Fixed version |
|---|---|---|
| Customer name with shortcode brackets, rendered twice | Shortcode ran on the second pass (5.7.0) | Brackets encoded, nothing ran (5.7.1) |
| Non-AND/OR key sent to the query builder | Key appeared in the SQL string (5.7.2) | Key rejected (5.7.3) |
| Customer role set to administrator | Stored and used (5.7.3) | Reset to customer role (5.7.4) |
| Serialized object in stored booking metadata | Object created on read (1.18.7.1) | Returned false, rows cleaned up (1.18.8) |

Booking Activities (3,000 installs) is the odd one out in that table. Its bug, CVE-2026-97248, is PHP object injection rather than authorization, and the fix came in two steps. Version 1.18.5 on August 3 stopped serialized values from being saved through text fields. Version 1.18.8 on September 11 stopped the plugin from unserializing stored metadata at all and deleted any existing rows that contained a serialized object. That fix also landed 17 days before disclosure.

We read the Simply Schedule Appointments and Bookly patches but didn't run them, so we'll describe only what the code says. Simply Schedule Appointments shipped fixes between September 9 and September 23. They restrict which request parameters can pull related records, including customer details and appointment tokens, into an API response, and they clean up a locale value that reached a file path (CVE-2026-89294). Bookly 28.4 on October 1 added a check that a staff member can only touch their own payments.

## What to Do on a Booking Site

Start by seeing which booking plugin versions you run and what's waiting:

```bash
wp plugin list --fields=name,status,version,update_version | grep -i -E "book|appoint|schedul|reserv|latepoint|amelia"
```

LatePoint should be on 5.7.4 or later, Booking Activities on 1.18.8 or later, and Simply Schedule Appointments on 1.6.12.33 or later. Bookly's current release is 28.5.

**Turn on auto-updates for the booking plugin.** Three fix releases in 19 days is a pace nobody keeps up with by hand: `wp plugin auto-updates enable latepoint`.

**Delete unused booking plugins.** Sites often carry a second scheduler from an old experiment. A deactivated plugin's files stay on disk.

**Check for premium add-ons.** Booknetic, WooCommerce Appointments, Radius Booking and Tourfic Pro each have a SQL injection or privilege escalation with no fixed version recorded in our database. Check the vendor changelog, and see our guide to [premium plugin licenses and security updates](/blog/premium-plugin-expired-license-security-updates).

**Keep the removal list short.** If a booking plugin has been closed in the directory or hasn't updated in a year, treat it as a replacement job, not a patch job. Our [abandoned plugin check](/blog/abandoned-wordpress-plugins-closed-plugin-check) shows how to find them.

## If You Ran an Old Version

Updating closes the hole but doesn't remove anything left behind. For the LatePoint shortcode bug, look for customers whose names contain brackets:

```bash
wp db query "SELECT id, first_name, last_name FROM wp_latepoint_customers WHERE first_name LIKE '%[%' OR last_name LIKE '%[%' OR notes LIKE '%[%'"
```

For the role setting, confirm it still says the customer role:

```bash
wp db query "SELECT name, value FROM wp_latepoint_settings WHERE name='default_wp_role_for_customer'"
```

If you ran Booking Activities below 1.18.8, count stored objects in its metadata table. Version 1.18.8 deletes them on update, so this should return zero afterwards:

```bash
wp db query "SELECT COUNT(*) FROM wp_bookacti_meta WHERE meta_value LIKE '%O:%'"
```

Then check the administrator list for accounts you don't recognize. Our guide to the [signs your WordPress site has been hacked](/blog/signs-wordpress-site-hacked) covers the rest, and the [malware removal guide](/blog/wordpress-malware-removal-guide) walks through cleanup. Table prefixes may differ from `wp_` on your site.

We keep the plugins worth patching first on our [weekly patch list](/blog/wordpress-plugins-to-patch-this-week). To check what's installed on your own site against the same database, [run a scan](/#scanner).

## References

- [Wordfence Intelligence vulnerability database](https://www.wordfence.com/threat-intel/vulnerabilities/)
- [WP Vanguard vulnerability database](/vulnerabilities)
- [LatePoint changelog on WordPress.org](https://wordpress.org/plugins/latepoint/#developers)
- [Booking Activities changelog on WordPress.org](https://wordpress.org/plugins/booking-activities/#developers)
- CVE-2026-92966, CVE-2026-96662, CVE-2026-104766 (LatePoint), CVE-2026-97248 (Booking Activities), CVE-2026-89294 (Simply Schedule Appointments)