CRITICALVulnerability
Verified
Global

NVD CRITICAL: CVE-2026-92966 — The The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordP...

·Source: NIST NVD

Updated:

Executive Summary

The The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.7.0. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbit

Analysis

The The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.7.0. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. The payload is planted during the unauthenticated booking flow and triggered when the Customer Cabinet block rendered by render_customer_dashboard() outputs the stored name into the content stream, where WordPress core's do_shortcode filter at priority 11 re-parses and executes it. CVSS Score: 9.1. Published: 2026-10-01T05:17:11.967.

Indicators of Compromise (1)

CVE (1)
CVE-2026-92966
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Oct 1, 2026. Verified by: NIST.

Related Threats

LOWVulnerabilityNEW

Crypto Scammers Hijack Microsoft’s Official X Account

Hackers used the account, which has 13 million followers, to amplify a Clippy-themed cryptocurrency account. The post Crypto Scammers Hijack Microsoft’s Official X Account appeared first on SecurityWeek .

SecurityWeek
MEDIUMVulnerabilityNEW

Why CISOs Struggle to Answer the Board's Three Hardest Questions, and How to Fix the Report

The quarterly board meeting is two weeks out. The security team is pulling exports from the identity provider, the cloud posture tool, the vulnerability scanner, the SIEM and the EDR console. Someone is building a spreadsheet to reconcile them. Someone else is turning that spreadsheet into slides. Then a board member asks three questions: How secure is the organization, overall? What is

The Hacker News
MEDIUMVulnerability

In Rare Move, Alleged Iranian State Hacker Extradited to US

Amir Barati, an alleged member of the Mabna Institute, was indicted for targeting universities, private organizations, and government entities in the US and abroad. The post In Rare Move, Alleged Iranian State Hacker Extradited to US appeared first on SecurityWeek .

SecurityWeek