CyberRota Analysis
AI-GeneratedThe LatePoint – Calendar Booking Plugin for WordPress is vulnerable to improper input validation, allowing unauthenticated attackers to exploit the Stripe Connect payment processor by submitting a valid PaymentIntent ID. This vulnerability could enable attackers to process unauthorized payments, potentially leading to financial loss for users. WordPress site administrators using this plugin should prioritize patching or updating to mitigate the risk of exploitation.
Original NVD Description
The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Improper Input Validation in all versions up to, and including, 5.4.0. This is due to the plugin's Stripe Connect payment processor accepting a client-supplied PaymentIntent ID. This makes it possible for unauthenticated attackers to pay an arbitrary amount by supplying a previously succeeded PaymentIntent token.