PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-100163 latepoint CVE debrief

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 5.7.2 via the OsCustomerHelper::create_wp_user_for_customer() helper reached from the public process_step_customer() booking step. When the 'Use WordPress users as customers' option is enabled, the helper falls back from email_exists() to username_exists( $customer->email ), which matches any WordPress user whose user_login equals the victim customer's email even when that user's user_email is completely different, and links that WordPress user's ID into the victim's LatePoint customer row (only privileged roles are excluded; Subscriber is allowed). This makes it possible for authenticated attackers, with Subscriber-level access and above, to take over another customer's LatePoint account — accessing their bookings, service, agent, and calendar data, and having the victim customer's email overwritten with the attacker's on next login — by holding a Subscriber account whose user_login equals the victim's email and submitting an unauthenticated public booking step registration request.

Vendor
latepoint
Product
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress
CVSS
HIGH 7.4
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-14
Original CVE updated
2026-10-14
Advisory published
2026-10-14
Advisory updated
2026-10-14

Who should care

Defenders responsible for WordPress installations with the Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress should assess their current version and configurations, and prioritize verifying and upgrading to a patched version.

Why it matters

CVE-2026-100163 is a high-severity authentication bypass vulnerability in the Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress. Defenders should prioritize verifying and upgrading to a patched version, assessing their current version and configurations, and monitoring for potential exploitation attempts. The vulnerability allows attackers with Subscriber-level access and above to take over another customer's LatePoint account.

  • Customer account takeover, allowing access to bookings, service, agent, and calendar data
  • Potential email overwrite with attacker's email on next login
  • Required verification of current version and configurations
  • Priority on upgrading to a patched version

Technical summary

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 5.7.2. The vulnerability is caused by insufficient verification in the create_wp_user_for_customer() function, which allows attackers to take over another customer's LatePoint account by holding a Subscriber account whose user_login equals the victim's email and submitting an unauthenticated public booking step registration request. This makes it possible for authenticated attackers, with Subscriber-level access and above, to access their bookings, service, agent, and calendar data, and have the victim customer's email overwritten with the

Defensive priority

Defenders should prioritize verifying and upgrading to a patched version of the Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress, assessing their current version and configurations, and monitoring for potential exploitation attempts.

Recommended defensive actions

  • Verify and upgrade to a patched version of the Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress
  • Assess current version and configurations
  • Monitor for potential exploitation attempts
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the vulnerability, including its description, affected versions, and references to the source code. The vulnerability is caused by insufficient verification in the create_wp_user_for_customer() function, which allows attackers to take over another customer's LatePoint account. Defenders should verify and upgrade to a patched version of the Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress, assessing their current version and configurations, and monitoring for

Sources and references

Verified primary and authoritative sources

  • CVE-2026-100163 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-100163

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-100163 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-100163

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Appointment Booking Plugin <= 5.7.2 - Unauthenticated Authentication Bypass to Customer Account

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/100xxx/CVE-2026-100163.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.2/lib/helpers/customer_helper.php

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.2/lib/helpers/steps_helper.php

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.2/latepoint.php

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.3/lib/helpers/customer_helper.php

    Supplemental source

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.