External risk intelligence

LatePoint Blind SQL Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-57714

LatePoint is a WordPress plugin used for appointment booking and customer management. Plugins of this type are typically installed on web servers and function as public-facing web interfaces to allow users to book appointments and interact with the site, making them directly reachable over the internet in common deployment patterns.

SQL Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability involves SQL Injection, a type of attack that can allow unauthorized access to or manipulation of data within a system. The affected technology is a plugin used for appointment booking and customer management, which is typically accessible via the internet. While the specific business impact requires further investigation into your deployment, this class of vulnerability can lead to significant data exposure or compromise.

Flaw allows unauthorized data access.
Confirms relevance and exposure is key.
Understand potential data implications.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending specially crafted requests over the network to the LatePoint application. If successful, this could allow them to inject malicious SQL commands, potentially leading to unauthorized access to sensitive data or disruption of service.

Attacker can reach the vulnerable component over the network.
Vulnerability is triggered by specially crafted SQL commands.
Risk of data exposure and service disruption.

Live Threat

Current exploitation, exposure, and threat context

A Blind SQL Injection vulnerability in LatePoint, when supported by the advisory's version context, could allow an unauthenticated attacker to infer information about the underlying database or its structure by submitting specially crafted input. This could potentially reveal details about the database schema, which might be useful for further attacks, though it does not directly expose sensitive data.

Database schema could be inferred.
Malicious input could be submitted via the application.
Inferred information may aid further attacks.

Operational Fix

Recommended remediation, mitigation, and detection steps

Teams responsible for this vulnerability will likely include application owners, platform teams managing the WordPress environment, and potentially vendor management if LatePoint is a third-party solution. The first practical step is to inventory all instances of LatePoint, verify internet reachability and business criticality, identify the accountable owner for each instance, and then prioritize remediation based on risk.

Application owners should prioritize remediation.
Verify all LatePoint installations and reachability.
Plan maintenance for risk-based patching.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the LatePoint plugin used for?

LatePoint is a WordPress plugin designed for appointment booking and customer management. It acts as a web-based interface that allows site visitors to schedule services and interact with business workflows directly through a web browser.

What does Blind SQL Injection mean for CVE-2026-57714?

This CVE involves a vulnerability class known as Improper Neutralization of Special Elements used in an SQL Command, or CWE-89. In this 'blind' scenario, an attacker cannot see the direct output of their malicious database queries but can infer sensitive details—like database structure or schema—by observing how the application responds to specifically crafted inputs.

How is this SQL injection vulnerability triggered?

An attacker triggers this flaw by sending specially crafted requests over the network to the affected plugin. It is important to note that this does not require a user to log in; however, standard, non-malicious interaction with the appointment booking interface does not trigger the bug.

Is my LatePoint installation at risk?

According to Halo Surface Signal, LatePoint is typically deployed as a public-facing web interface to facilitate customer scheduling. Because these plugins are designed to be reachable over the internet, installations are generally considered network-accessible, which increases the likelihood that they are reachable by unauthorized parties.

What should I do if I run LatePoint?

Your first step is to create an inventory of all WordPress sites where the LatePoint plugin is active. Once identified, verify which instances are accessible from the internet, determine the business importance of those specific sites, and coordinate with the team managing those environments to plan for necessary software updates.

References

patchstack.com/database/Wordpress/Plugin/latepoint/vulnerability/wor…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.