{"id":"CVE-2026-118066","kind":"vulnerability","aliases":["CVE-2026-118066"],"related":[],"title":"LatePoint WordPress plugin: unauthenticated SQL injection lets attackers take over customer accounts","description":"The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Authentication Bypass via Account Takeover in all versions up to, and including, 5.7.6. This is due to the `OsModel::build_conditions_query()` function in `lib/models/model.php` comparing WHERE-clause values against the literal strings `'IS NULL'` and `'IS NOT NULL'` and concatenating a match directly into SQL without binding it as a parameter, a flaw that neither `sanitize_text_field()` nor the 5.7.5 `is_scalar()` hardening guard closes, since both pass the scalar sentinel through unchanged. This makes it possible for unauthenticated attackers to send `params[password_reset_token]=IS NOT NULL` to the public `customer_cabinet__change_password` AJAX route to match every non-null `account_nonse` value, resolving to the lowest-id customer and overwriting that customer's password to an attacker-chosen value — granting full access to their bookings, orders, and PII, and, when the `wp_users_as_customers` option is enabled, takeover of the linked WordPress subscriber or customer-role account. The attacker can first identify the target customer's email by sending `params[order_intent_key]=IS NOT NULL` to the public `steps__start_from_order_intent` route, which returns the name and email from the first matching order intent, and can then self-arm the required 15-minute password-reset freshness window by triggering a reset for that customer directly.","summary":"The LatePoint appointment booking plugin for WordPress, in all versions up to and including 5.7.6, builds a SQL WHERE clause from attacker-supplied values, so a public AJAX request using the literal string 'IS NOT NULL' matches every customer. An unauthenticated attacker can then overwrite the password of the lowest-id customer and gain access to their bookings, orders and personal data, and the linked WordPress account when the wp_users_as_customers option is on.","severity":"critical","cvss":9.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["appointment-booking","latepoint","package","woocommerce","wordpress"],"not_affected_if":["patched-version","plugin-not-installed"],"how_to_check":"- Check whether the LatePoint plugin is installed and its version is at most `5.7.6` in the WordPress plugins screen or the plugin header in `wp-content/plugins/`\n- Check whether the `wp_users_as_customers` option is enabled in LatePoint settings, which raises the impact to WordPress accounts","fix":"- LatePoint plugin: unknown (the sources do not state a fixed version; the description only says all versions up to and including `5.7.6` are affected)","status":"open","published_at":"2026-11-07T12:17:43+00:00","first_seen_at":"2026-11-07T12:47:08+00:00","triaged_at":"2026-11-07T12:48:36+00:00","updated_at":"2026-11-07T12:48:36+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-07T12:48:36Z","model":"claude-haiku-5-5","output":{"fix":"- LatePoint plugin: unknown (the sources do not state a fixed version; the description only says all versions up to and including `5.7.6` are affected)","reach":"internet","title":"LatePoint WordPress plugin: unauthenticated SQL injection lets attackers take over customer accounts","impact":"high","summary":"The LatePoint appointment booking plugin for WordPress, in all versions up to and including 5.7.6, builds a SQL WHERE clause from attacker-supplied values, so a public AJAX request using the literal string 'IS NOT NULL' matches every customer. An unauthenticated attacker can then overwrite the password of the lowest-id customer and gain access to their bookings, orders and personal data, and the linked WordPress account when the wp_users_as_customers option is on.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","woocommerce","appointment-booking","latepoint"],"confidence":0.8,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker takes over customer accounts, reading bookings, orders and personal data","analyst_note":"Confirm the first fixed LatePoint version from the WordPress plugin changelog or the Wordfence/NVD record; the sources give no fixed version.","how_to_check":"- Check whether the LatePoint plugin is installed and its version is at most `5.7.6` in the WordPress plugins screen or the plugin header in `wp-content/plugins/`\n- Check whether the `wp_users_as_customers` option is enabled in LatePoint settings, which raises the impact to WordPress accounts","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","patched-version"],"who_is_affected":"Any WordPress site running the LatePoint appointment booking plugin at version 5.7.6 or earlier is exposed, because the vulnerable public AJAX routes are reachable without logging in. The risk is highest when the wp_users_as_customers option links customers to WordPress accounts, since takeover then extends to WordPress subscriber or customer accounts. Sites where the plugin is not installed, or is updated beyond the affected range once a fix is published, can skip it.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"critical"},"cost_usd":0.000859,"input_tokens":4648,"output_tokens":789,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-118066':15A,18A '-2026':14A,17A '15':324C '5.7.5':179C '5.7.6':40B,129C 'access':82B,248C 'account':12A,94B,120C,224C,275C 'ajax':54B,216C 'appoint':20B,28B,103C 'appointment-book':19B 'arm':321C 'attack':8A,48B,68B,199C,243C,277C 'attacker-chosen':242C 'attacker-suppli':47B 'authent':117C 'bind':165C 'book':21B,29B,85B,104C,251C 'build':41B,136C 'bypass':118C 'cabinet':213C 'calendar':107C 'chang':214C 'chosen':244C 'claus':45B,145C 'close':184C 'compar':142C 'concaten':158C 'condit':137C 'custom':11A,65B,79B,100B,212C,233C,237C,261C,273C,283C,337C 'customer-rol':272C 'cve':13A,16A 'data':89B 'direct':161C,338C 'due':132C 'email':285C,309C 'enabl':264C 'everi':64B,220C 'field':176C 'first':279C,312C 'flaw':171C 'fresh':329C 'full':247C 'function':139C 'gain':81B 'grant':246C 'guard':183C 'harden':182C 'id':78B,232C 'identifi':280C 'includ':39B,128C 'inject':6A 'intent':290C,302C,315C 'key':291C 'latepoint':1A,22B,27B,106C 'let':7A 'lib/models/model.php':141C 'link':92B,268C 'liter':58B,149C 'lowest':77B,231C 'lowest-id':76B,230C 'make':194C 'match':63B,160C,219C,313C 'minut':325C 'name':307C 'neither':173C 'non':222C 'non-nul':221C 'nons':225C 'null':62B,152C,156C,208C,223C,294C 'option':101B,262C 'order':86B,252C,289C,301C,314C 'osmodel':135C 'overwrit':71B,235C 'packag':23B 'param':202C,288C 'paramet':169C 'pass':187C 'password':73B,203C,215C,239C,327C 'password-reset':326C 'person':88B 'pii':254C 'plugin':3A,30B,105C,111C 'possibl':196C 'public':53B,211C,297C 'queri':138C 'request':55B 'requir':323C 'reset':204C,328C,334C 'resolv':227C 'return':305C 'role':274C 'rout':217C,303C 'sanit':174C 'scalar':181C,189C 'schedul':108C 'self':320C 'self-arm':319C 'send':201C,287C 'sentinel':190C 'sinc':185C 'sql':5A,43B,163C 'start':299C 'step':298C 'string':59B,150C 'subscrib':270C 'suppli':49B 'take':9A 'takeov':121C,265C 'target':282C 'text':175C 'token':205C 'trigger':332C 'unauthent':4A,67B,198C 'unchang':192C 'use':56B 'user':98B,259C 'valu':50B,146C,226C,245C 'version':35B,124C 'via':119C 'vulner':115C 'where-claus':143C 'window':330C 'without':164C 'woocommerc':24B 'wordpress':2A,25B,32B,93B,110C,113C,269C 'wp':97B,258C","nicknames":[],"mitigations":[],"who_affected":"Any WordPress site running the LatePoint appointment booking plugin at version 5.7.6 or earlier is exposed, because the vulnerable public AJAX routes are reachable without logging in. The risk is highest when the wp_users_as_customers option links customers to WordPress accounts, since takeover then extends to WordPress subscriber or customer accounts. Sites where the plugin is not installed, or is updated beyond the affected range once a fix is published, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["appointmentbooking","critical","latepoint","package","woocommerce","wordpress"],"campaign_type":null,"search_a":"'-118066':15A,18A '-2026':14A,17A 'account':12A 'attack':8A 'custom':11A 'cve':13A,16A 'inject':6A 'latepoint':1A 'let':7A 'plugin':3A 'sql':5A 'take':9A 'unauthent':4A 'wordpress':2A","search_b":"'5.7.6':40B 'access':82B 'account':94B 'ajax':54B 'appoint':20B,28B 'appointment-book':19B 'attack':48B,68B 'attacker-suppli':47B 'book':21B,29B,85B 'build':41B 'claus':45B 'custom':65B,79B,100B 'data':89B 'everi':64B 'gain':81B 'id':78B 'includ':39B 'latepoint':22B,27B 'link':92B 'liter':58B 'lowest':77B 'lowest-id':76B 'match':63B 'null':62B 'option':101B 'order':86B 'overwrit':71B 'packag':23B 'password':73B 'person':88B 'plugin':30B 'public':53B 'request':55B 'sql':43B 'string':59B 'suppli':49B 'unauthent':67B 'use':56B 'user':98B 'valu':50B 'version':35B 'woocommerc':24B 'wordpress':25B,32B,93B 'wp':97B","search_c":"'15':324C '5.7.5':179C '5.7.6':129C 'access':248C 'account':120C,224C,275C 'ajax':216C 'appoint':103C 'arm':321C 'attack':199C,243C,277C 'attacker-chosen':242C 'authent':117C 'bind':165C 'book':104C,251C 'build':136C 'bypass':118C 'cabinet':213C 'calendar':107C 'chang':214C 'chosen':244C 'claus':145C 'close':184C 'compar':142C 'concaten':158C 'condit':137C 'custom':212C,233C,237C,261C,273C,283C,337C 'customer-rol':272C 'direct':161C,338C 'due':132C 'email':285C,309C 'enabl':264C 'everi':220C 'field':176C 'first':279C,312C 'flaw':171C 'fresh':329C 'full':247C 'function':139C 'grant':246C 'guard':183C 'harden':182C 'id':232C 'identifi':280C 'includ':128C 'intent':290C,302C,315C 'key':291C 'latepoint':106C 'lib/models/model.php':141C 'link':268C 'liter':149C 'lowest':231C 'lowest-id':230C 'make':194C 'match':160C,219C,313C 'minut':325C 'name':307C 'neither':173C 'non':222C 'non-nul':221C 'nons':225C 'null':152C,156C,208C,223C,294C 'option':262C 'order':252C,289C,301C,314C 'osmodel':135C 'overwrit':235C 'param':202C,288C 'paramet':169C 'pass':187C 'password':203C,215C,239C,327C 'password-reset':326C 'pii':254C 'plugin':105C,111C 'possibl':196C 'public':211C,297C 'queri':138C 'requir':323C 'reset':204C,328C,334C 'resolv':227C 'return':305C 'role':274C 'rout':217C,303C 'sanit':174C 'scalar':181C,189C 'schedul':108C 'self':320C 'self-arm':319C 'send':201C,287C 'sentinel':190C 'sinc':185C 'sql':163C 'start':299C 'step':298C 'string':150C 'subscrib':270C 'takeov':121C,265C 'target':282C 'text':175C 'token':205C 'trigger':332C 'unauthent':198C 'unchang':192C 'user':259C 'valu':146C,226C,245C 'version':124C 'via':119C 'vulner':115C 'where-claus':143C 'window':330C 'without':164C 'wordpress':110C,113C,269C 'wp':258C","first_public_at":"2026-11-07T12:17:43+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118066","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118066","severity":null,"published_at":"2026-11-07T12:17:43+00:00","modified_at":"2026-11-07T12:17:43+00:00","first_seen_at":"2026-11-07T12:47:08+00:00","fetched_at":"2026-11-07T12:47:08+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}