IT SBIT Services
Schneeberger
DEEN
CVE tracker

LatePoint Appointment Booking Plugin: Authentication bypass via race condition in OTP verification

CVE-2026-110653Critical 9.1

← All vulnerabilities

Summary

The WordPress plugin LatePoint (all versions up to and including 5.7.4) fails to enforce the 10-attempt limit on OTP verification under concurrent requests. An unauthenticated attacker who knows a customer's registered email address or phone number can send parallel requests to the OTP verification endpoint, brute-force the 6-digit code and log in as that customer. This exposes bookings and personal data of customer accounts.

Affected

  • LatePoint Appointment Booking Plugin for WordPress, all versions up to and including 5.7.4

Fixed in

  • Version 5.7.5 is reported as the fix by WPScan; the vendor changelog does not name this CVE. Version 5.7.6 is the latest release at the time of writing.

Workaround

  • Unknown. No vendor-published workaround. Possible general measures: rate-limit or block requests to the OTP verification endpoint at the WAF or reverse proxy, and monitor for bursts of verification attempts.

Exploitation

  • Not listed in the CISA KEV catalog; no known active exploitation.
  • No public proof-of-concept known so far.
  • CISA SSVC: automatable yes, technical impact total.

Our recommendation

  • Update LatePoint to 5.7.6 (at least 5.7.5) on all WordPress sites, including staging sites, and verify the installed version.
  • Until patched, restrict or rate-limit the OTP verification endpoint and monitor for brute-force patterns and logins after many failed attempts.
  • Check customer accounts for unexpected logins or bookings and assess whether personal data was affected.

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 06:23.

Original description (NVD)

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Authentication Bypass via Race Condition in all versions up to, and including, 5.7.4. This is due to a non-atomic read-modify-write on the OTP verification attempts counter in the `verifyOTP` function: the counter is incremented using a stale in-memory value with no conditional `WHERE attempts < 10` guard on the `UPDATE` and no `SELECT ... FOR UPDATE` row lock, creating a TOCTOU window that allows concurrent requests to bypass the 10-attempt lockout. This makes it possible for unauthenticated attackers — who know a target customer's registered email address or phone number — to fire concurrent requests to the `auth__verify_otp` endpoint, defeat the lockout cap, brute-force the 6-digit OTP code, and authenticate as the targeted LatePoint customer, gaining full access to their account, bookings, and personal data. The nonce check present on the endpoint (`otp_verify_otp_nonce`) does not mitigate this issue, as the nonce is publicly emitted by the unauthenticated `request_otp` and `resend_otp` endpoints and is trivially obtainable by any unauthenticated attacker prior to launching the race.

NVD references (7)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed