{"id":"CVE-2026-110653","kind":"vulnerability","aliases":["CVE-2026-110653"],"related":[],"title":"The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable…","description":"The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Authentication Bypass via Race Condition in all versions up to, and including, 5.7.4. This is due to a non-atomic read-modify-write on the OTP verification attempts counter in the `verifyOTP` function: the counter is incremented using a stale in-memory value with no conditional `WHERE attempts < 10` guard on the `UPDATE` and no `SELECT ... FOR UPDATE` row lock, creating a TOCTOU window that allows concurrent requests to bypass the 10-attempt lockout. This makes it possible for unauthenticated attackers — who know a target customer's registered email address or phone number — to fire concurrent requests to the `auth__verify_otp` endpoint, defeat the lockout cap, brute-force the 6-digit OTP code, and authenticate as the targeted LatePoint customer, gaining full access to their account, bookings, and personal data. The nonce check present on the endpoint (`otp_verify_otp_nonce`) does not mitigate this issue, as the nonce is publicly emitted by the unauthenticated `request_otp` and `resend_otp` endpoints and is trivially obtainable by any unauthenticated attacker prior to launching the race.","summary":"LatePoint, a WordPress appointment booking plugin, has a race condition in its OTP login check that lets concurrent requests bypass the 10-attempt lockout. An unauthenticated attacker who knows a customer's email or phone can brute-force the 6-digit code and log in as that customer, reaching their account, bookings and personal data.","severity":"critical","cvss":9.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["customer-accounts","latepoint","package","wordpress"],"not_affected_if":["plugin-not-installed","version-above-5.7.4"],"how_to_check":"Check the installed LatePoint version in the WordPress plugins screen or the plugin header; unknown whether a file or setting check is available.","fix":"Update LatePoint to a release newer than 5.7.4; the patched version is unknown from the sources.","status":"open","published_at":"2026-10-17T03:16:28+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","triaged_at":"2026-10-23T22:13:36+00:00","updated_at":"2026-10-23T22:28:55+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-23T22:13:36Z","model":"claude-haiku-5-5","output":{"fix":"Update LatePoint to a release newer than 5.7.4; the patched version is unknown from the sources.","reach":"internet","impact":"high","summary":"LatePoint, a WordPress appointment booking plugin, has a race condition in its OTP login check that lets concurrent requests bypass the 10-attempt lockout. An unauthenticated attacker who knows a customer's email or phone can brute-force the 6-digit code and log in as that customer, reaching their account, bookings and personal data.","category":"package","who_cares":["wordpress","latepoint","customer-accounts"],"confidence":0.8,"needs_auth":"no","worst_case":"Attacker logs in as customers and reads their bookings and personal data","analyst_note":"Confirm the patched LatePoint version and whether an OTP-related setting disables the flaw; check the NVD entry and the plugin changelog.","how_to_check":"Check the installed LatePoint version in the WordPress plugins screen or the plugin header; unknown whether a file or setting check is available.","needs_analyst":true,"not_affected_if":["plugin-not-installed","version-above-5.7.4"],"user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"critical"},"cost_usd":0.000523,"input_tokens":3107,"output_tokens":424,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-110653':17A,20A '-2026':16A,19A '10':48B,149C,172C '5.7.4':110C '6':67B,212C 'access':225C 'account':23B,78B,228C 'address':190C 'allow':166C 'appoint':2A,30B,84C 'atom':118C 'attack':53B,181C,271C 'attempt':49B,127C,148C,173C 'auth':200C 'authent':98C,217C 'book':3A,31B,79B,85C,229C 'brute':64B,209C 'brute-forc':63B,208C 'bypass':46B,99C,170C 'calendar':6A,88C 'cap':207C 'check':41B,235C 'code':69B,215C 'concurr':44B,167C,196C 'condit':36B,102C,146C 'counter':128C,134C 'creat':161C 'custom':22B,57B,75B,186C,222C 'customer-account':21B 'cve':15A,18A 'data':82B,232C 'defeat':204C 'digit':68B,213C 'due':113C 'email':59B,189C 'emit':254C 'endpoint':203C,239C,263C 'fire':195C 'forc':65B,210C 'full':224C 'function':132C 'gain':223C 'guard':150C 'in-memori':140C 'includ':109C 'increment':136C 'issu':248C 'know':55B,183C 'latepoint':5A,24B,27B,87C,221C 'launch':274C 'let':43B 'lock':160C 'lockout':50B,174C,206C 'log':71B 'login':40B 'make':176C 'memori':142C 'mitig':246C 'modifi':121C 'non':117C 'non-atom':116C 'nonc':234C,243C,251C 'number':193C 'obtain':267C 'otp':39B,125C,202C,214C,240C,242C,259C,262C 'packag':25B 'person':81B,231C 'phone':61B,192C 'plugin':4A,10A,32B,86C,92C 'possibl':178C 'present':236C 'prior':272C 'public':253C 'race':35B,101C,276C 'reach':76B 'read':120C 'read-modify-writ':119C 'regist':188C 'request':45B,168C,197C,258C 'resend':261C 'row':159C 'schedul':7A,89C 'select':156C 'stale':139C 'target':185C,220C 'toctou':163C 'trivial':266C 'unauthent':52B,180C,257C,270C 'updat':153C,158C 'use':137C 'valu':143C 'verif':126C 'verifi':201C,241C 'verifyotp':131C 'version':105C 'via':100C 'vulner':14A,96C 'window':164C 'wordpress':9A,12A,26B,29B,91C,94C 'write':122C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-17T03:16:28+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-110653","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110653","severity":null,"published_at":"2026-10-17T03:16:28+00:00","modified_at":"2026-10-19T15:16:45+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}