CVE-2026-1487

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-1487", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-01-27T13:40:10.237Z", "datePublished": "2026-03-03T01:21:51.239Z", "dateUpdated": "2026-04-08T17:29:02.092Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:29:02.092Z"}, "affected": [{"vendor": "latepoint", "product": "LatePoint \u2013 Calendar Booking Plugin for Appointments and Events", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "5.2.7", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The LatePoint \u2013 Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to SQL Injection via the JSON Import in all versions up to, and including, 5.2.7 due to insufficient validation on the user-supplied JSON data. This makes it possible for authenticated attackers, with Administrator-level access and above, to execute arbitrary SQL queries on the database that can be used to extract information via time-based techniques, drop tables, or modify data."}], "title": "LatePoint <= 5.2.7 - Authenticated (Administrator+) SQL Injection via JSON Import", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e1bbd339-5eb7-4a62-9c68-bcd76507425c?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3463945/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "cweId": "CWE-89", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N", "baseScore": 6.5, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Chiao-Lin Yu"}], "timeline": [{"time": "2026-01-23T00:00:00.000Z", "lang": "en", "value": "Discovered"}, {"time": "2026-01-27T13:56:44.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2026-03-02T11:25:27.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-03T15:57:18.083203Z", "id": "CVE-2026-1487", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-03T16:06:59.020Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-1487", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-03T15:57:18.083203Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-03T15:57:39.561Z"}}], "cna": {"title": "LatePoint <= 5.2.7 - Authenticated (Administrator+) SQL Injection via JSON Import", "credits": [{"lang": "en", "type": "finder", "value": "Chiao-Lin Yu"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N"}}], "affected": [{"vendor": "latepoint", "product": "LatePoint \u2013 Calendar Booking Plugin for Appointments and Events", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "5.2.7"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-01-23T00:00:00.000Z", "value": "Discovered"}, {"lang": "en", "time": "2026-01-27T13:56:44.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2026-03-02T11:25:27.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e1bbd339-5eb7-4a62-9c68-bcd76507425c?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3463945/"}], "descriptions": [{"lang": "en", "value": "The LatePoint \u2013 Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to SQL Injection via the JSON Import in all versions up to, and including, 5.2.7 due to insufficient validation on the user-supplied JSON data. This makes it possible for authenticated attackers, with Administrator-level access and above, to execute arbitrary SQL queries on the database that can be used to extract information via time-based techniques, drop tables, or modify data."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-89", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:29:02.092Z"}}}, "cveMetadata": {"cveId": "CVE-2026-1487", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:29:02.092Z", "dateReserved": "2026-01-27T13:40:10.237Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-03-03T01:21:51.239Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "LatePoint \u2013 Calendar Booking Plugin for Appointments and Events", "vendor": "latepoint", "versions": [{"lessThanOrEqual": "5.2.7", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The LatePoint \u2013 Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to SQL Injection via the JSON Import in all versions up to, and including, 5.2.7 due to insufficient validation on the user-supplied JSON data. This makes it possible for authenticated attackers, with Administrator-level access and above, to execute arbitrary SQL queries on the database that can be used to extract information via time-based techniques, drop tables, or modify data."}, {"lang": "es", "value": "El plugin LatePoint \u2013 Calendar Booking Plugin para Appointments and Events para WordPress es vulnerable a inyecci\u00f3n SQL a trav\u00e9s de la importaci\u00f3n JSON en todas las versiones hasta la 5.2.7, inclusive, debido a una validaci\u00f3n insuficiente de los datos JSON proporcionados por el usuario. Esto hace posible que atacantes autenticados, con acceso de nivel de Administrador y superior, ejecuten consultas SQL arbitrarias en la base de datos que pueden usarse para extraer informaci\u00f3n a trav\u00e9s de t\u00e9cnicas basadas en tiempo, eliminar tablas o modificar datos."}], "id": "CVE-2026-1487", "lastModified": "2026-06-17T10:15:53.017", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 5.2, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-1487", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-03-03T15:57:18.083203Z", "version": "2.0.3"}}]}, "published": "2026-03-03T02:16:07.633", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3463945/"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e1bbd339-5eb7-4a62-9c68-bcd76507425c?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,5.2.7]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "LatePoint \u2013 Calendar Booking Plugin for Appointments and Events", "source": "cna", "vendor": "latepoint"}, "product": "latepoint_\u2013_calendar_booking_plugin_for_appointments_and_events", "vendor": "latepoint"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-15T16:51:36.188510+00:00", "value": {"mitigation_remediation": ["Upgrade LatePoint to version 5.2.8 or newer", "If upgrading is not immediately possible, restrict the JSON import functionality to the minimum set of trusted administrators and monitor import activity for suspicious patterns", "Implement additional input validation on uploaded JSON files to enforce strict format and escape all user data before database queries"], "summary": {"action": "Upgrade", "impact": "Database Manipulation and Information Disclosure"}, "threat_synthesis": {"affected_systems": "LatePoint \u2013 Calendar Booking Plugin for Appointments and Events plugin for WordPress, versions 5.2.7 and earlier.", "description_and_impact": "Authenticated administrators with access to the LatePoint JSON import feature can supply malformed JSON that bypasses server\u2011side validation. The plugin\u2019s input sanitization flaw allows an attacker to inject arbitrary SQL statements, enabling the execution of time\u2011based queries, data extraction, table deletion, or data alteration. The impact is a compromise of database confidentiality, integrity, and availability within the WordPress site, limited to users with at least administrator privileges.", "risk_and_exploitability": "The CVSS score of 6.5 indicates moderate severity. EPSS is less than 1\u202f% suggesting a very low likelihood of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves an authenticated administrator using the JSON import interface; no external access or elevated privileges beyond the administrator role are required, and no public exploit has been reported in the provided references."}}}}, "created": "2026-03-04T14:54:35.075218+00:00", "updated": "2026-04-15T17:00:07.068161+00:00", "vendors": ["latepoint", "latepoint$PRODUCT$latepoint_\u2013_calendar_booking_plugin_for_appointments_and_events", "wordpress", "wordpress$PRODUCT$wordpress"]}