CVE-2026-100163

Deferred Deferred - Pending Action

Authentication Bypass in LatePoint WordPress Plugin

Publication date: 2026-10-14

Last updated on: 2026-10-14

Assigner: Wordfence

Description

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 5.7.2 via the OsCustomerHelper::create_wp_user_for_customer() helper reached from the public process_step_customer() booking step. When the 'Use WordPress users as customers' option is enabled, the helper falls back from email_exists() to username_exists( $customer->email ), which matches any WordPress user whose user_login equals the victim customer's email even when that user's user_email is completely different, and links that WordPress user's ID into the victim's LatePoint customer row (only privileged roles are excluded; Subscriber is allowed). This makes it possible for authenticated attackers, with Subscriber-level access and above, to take over another customer's LatePoint account — accessing their bookings, service, agent, and calendar data, and having the victim customer's email overwritten with the attacker's on next login — by holding a Subscriber account whose user_login equals the victim's email and submitting an unauthenticated public booking step registration request.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-100163

EUVD

EUVD-2026-100900

Affected Vendors & Products

Vendor	Product	Version / Range
latepoint	Appointment	Booking Plugin – LatePoint \| Calendar & Scheduling for WordPress 0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-287	When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

Executive Summary

This vulnerability is an Authentication Bypass in the Appointment Booking Plugin for WordPress. It allows attackers with Subscriber-level access or higher to take over another customer's LatePoint account by exploiting a flaw in the user creation process. When the 'Use WordPress users as customers' option is enabled, the plugin incorrectly matches WordPress users based on email addresses, enabling attackers to link their account to a victim's data.

Detection Guidance

Check if the Appointment Booking Plugin – LatePoint is installed and verify its version. If it is version 5.7.2 or lower, the system is vulnerable. Inspect WordPress user accounts for any user_login values matching customer emails, as this could indicate exploitation. Review LatePoint customer data for unauthorized account linkages.

Impact Analysis

If you use the affected plugin, an attacker could gain access to your bookings, service details, agent information, and calendar data. They could also overwrite your email address with theirs during login, potentially disrupting your account access and communications.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive personal data, violating GDPR and HIPAA requirements for data protection and access control. Organizations using this plugin may face compliance breaches, legal penalties, and reputational damage due to potential data exposure.

Mitigation Strategies

Immediately update the Appointment Booking Plugin – LatePoint to the latest version to patch the authentication bypass vulnerability. Disable the 'Use WordPress users as customers' option if not required. Review user accounts for unauthorized access or modifications and revoke any suspicious Subscriber-level accounts.

Hi! I’m here to help you understand CVE-2026-100163. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70