LatePoint Authentication Bypass: Critical Flaw in WordPress Bookings

What the flaw is and who it affectsThe Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress is affected by an authenticati...

What the flaw is and who it affects

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress is affected by an authentication bypass, tracked as CVE-2026-110653. According to the National Vulnerability Database (NVD) of NIST, the problem exists in all versions up to, and including, 5.7.4. The flaw is classified as CWE-287 (improper authentication) and carries a CVSS 3.1 score of 9.1, rated CRITICAL (vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N). It was published in the NVD on 17 October 2026.

The root cause is a race condition. The plugin verifies one-time passwords (OTPs) in a function called verifyOTP, where the counter of verification attempts is read and written in a non-atomic way: the increment uses a stale in-memory value, the database update carries no conditional guard limiting attempts to fewer than ten, and there is no row lock on the read. That opens a time-of-check-to-time-of-use (TOCTOU) window in which concurrent requests can slip past the ten-attempt lockout. An unauthenticated attacker who knows a customer's registered email address or phone number can fire parallel requests at the auth__verify_otp endpoint, defeat the cap and brute-force the six-digit code. The result is a full login as that customer, with access to their account, bookings and personal data.

The nonce check on the endpoint does not help: the nonce is publicly emitted by the unauthenticated request_otp and resend_otp endpoints, so any attacker can obtain it before launching the race. This matters for any Spanish pyme, online shop or clinic running WordPress with LatePoint for appointments, especially where bookings hold names, contact details and GDPR-protected personal data.

Why it is serious, even without known exploitation

As of the NVD publication, CVE-2026-110653 does not appear in CISA's KEV catalogue, so there is no public record of it being exploited in real attacks. That is not a reason to relax. The attack needs no credentials, no user interaction and no special conditions beyond knowing a customer's email or phone number, and the CVSS vector reflects high impact on both confidentiality and integrity. A critical authentication bypass on a bookings system is precisely the kind of flaw that gets picked up quickly once proof-of-concept details circulate, and the data behind those accounts is exactly what GDPR obliges you to protect.

What to do today

Check whether you use it and in which version. In the WordPress dashboard, look at the installed version of the LatePoint plugin. Anything up to and including 5.7.4 falls inside the affected range.
Apply the fix from the vendor's advisory. The NVD references point to changes in version 5.7.5 of the plugin, but confirm the corrected version and any extra mitigation in the official LatePoint security notice before acting, and follow its instructions rather than assuming a single number solves everything.
Look for signs of intrusion. Review access logs for bursts of concurrent requests to the OTP verification endpoint, unusual logins on customer accounts and bookings or personal data that appear altered.
Reduce what is exposed. If you cannot update immediately, restrict or temporarily disable the OTP-based customer login, and review which plugin endpoints are reachable from the internet.
Reset where needed. If you find evidence of abuse, force credential resets for affected accounts and notify as required under GDPR.

How a cybersecurity team like ALMC's can help

Keeping track of critical CVEs across a WordPress stack is a full-time job for a small IT team. At ALMC we work with pymes, online shops and businesses across Lleida, Barcelona, Tarragona and Girona on exactly this: security audits and pentesting to find weaknesses before someone else does, hardening of servers and CMS installations, and maintenance and updating of WordPress, PrestaShop and Joomla so that patches like this one land on time. When something does go wrong, we handle incident response and repair hacked websites, and we keep monitoring in place so the next critical advisory does not catch you by surprise.

Is your business exposed to flaws like this?

ALMC checks which versions you are running, applies the patches and hardens your servers and website. Contact our team for a security review.

Results without leaving the page.