LatePoint WordPress plugin: unauthenticated SQL injection lets attackers take over customer accounts

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Authentication Bypass via Account Takeover in all versions up to, and including, 5.7.6. This is due to the OsModel::build_conditions_query() function in lib/models/model.php comparing WHERE-clause values against the literal strings 'IS NULL' and 'IS NOT NULL' and concatenating a match directly into SQL without binding it as a parameter, a flaw that neither sanitize_text_field() nor the 5.7.5 is_scalar() hardening guard closes, since both pass the scalar sentinel through unchanged. This makes it possible for unauthenticated attackers to send params[password_reset_token]=IS NOT NULL to the public customer_cabinet__change_password AJAX route to match every non-null account_nonse value, resolving to the lowest-id customer and overwriting that customer's password to an attacker-chosen value — granting full access to their bookings, orders, and PII, and, when the wp_users_as_customers option is enabled, takeover of the linked WordPress subscriber or customer-role account. The attacker can first identify the target customer's email by sending to the public route, which returns the name and email from the first matching order intent, and can then self-arm the required 15-minute password-reset freshness window by triggering a reset for that customer directly.