CVE-2026-110653
Received Received - Intake

Authentication Bypass via Race Condition in LatePoint WordPress Plugin

Publication date: 2026-10-17

Last updated on: 2026-10-17

Assigner: Wordfence

Description
The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Authentication Bypass via Race Condition in all versions up to, and including, 5.7.4. This is due to a non-atomic read-modify-write on the OTP verification attempts counter in the `verifyOTP` function: the counter is incremented using a stale in-memory value with no conditional `WHERE attempts < 10` guard on the `UPDATE` and no `SELECT ... FOR UPDATE` row lock, creating a TOCTOU window that allows concurrent requests to bypass the 10-attempt lockout. This makes it possible for unauthenticated attackers — who know a target customer's registered email address or phone number — to fire concurrent requests to the `auth__verify_otp` endpoint, defeat the lockout cap, brute-force the 6-digit OTP code, and authenticate as the targeted LatePoint customer, gaining full access to their account, bookings, and personal data. The nonce check present on the endpoint (`otp_verify_otp_nonce`) does not mitigate this issue, as the nonce is publicly emitted by the unauthenticated `request_otp` and `resend_otp` endpoints and is trivially obtainable by any unauthenticated attacker prior to launching the race.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-17
Last Modified
2026-10-17
Generated
2026-10-17
AI Q&A
2026-10-17
EPSS Evaluated
N/A
NVD
CVE-2026-110653
EUVD
EUVD-2026-103217

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
latepoint Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-287 When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Appointment Booking Plugin for WordPress has an authentication bypass flaw due to a race condition in versions up to 5.7.4. The vulnerability allows unauthenticated attackers to bypass the OTP verification lockout by exploiting a non-atomic counter increment in the verifyOTP function. This creates a time-of-check to time-of-use window where concurrent requests can defeat the 10-attempt limit and brute-force a 6-digit OTP code.

Detection Guidance

This vulnerability is specific to the Appointment Booking Plugin – LatePoint for WordPress and requires checking plugin versions and monitoring authentication attempts. Use WordPress admin to verify plugin version is not up to 5.7.4 or lower. Check server logs for unusual bursts of OTP verification requests from the same IP or email.

Impact Analysis

If you use this plugin, attackers could gain full access to your account by brute-forcing the OTP code. They could view your bookings, personal data, and perform unauthorized actions. The attack requires knowing your registered email or phone number but no other authentication.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive personal data, violating GDPR's data protection principles and HIPAA's security requirements for protected health information. Organizations using this plugin may face compliance violations and potential fines.

Mitigation Strategies

Update the Appointment Booking Plugin – LatePoint to the latest version beyond 5.7.4 immediately to patch the race condition vulnerability. Disable OTP-based authentication temporarily if possible and monitor for unauthorized access attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-110653. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart