CVE-2026-110653 latepoint CVE debrief

Who should care

Defenders responsible for WordPress installations with the Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress should assess exposure and prioritize verification and updates to prevent potential authentication bypass and unauthorized access to customer accounts.

Why it matters

CVE-2026-110653 is a critical vulnerability in the Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress that allows unauthenticated attackers to bypass authentication and gain access to customer accounts, bookings, and personal data. Defenders should prioritize verification, updates, and monitoring to prevent potential attacks.

• Verify and update to a fixed version to prevent authentication bypass
• Assess exposure of customer accounts and personal data to potential unauthorized access
• Monitor for suspicious authentication attempts to detect potential attacks
• Implement additional security measures to prevent brute-force attacks

Technical summary

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Authentication Bypass via Race Condition in all versions up to, and including, 5.7.4. This is due to a non-atomic read-modify-write on the OTP verification attempts counter in the `verifyOTP` function: the counter is incremented using a stale in-memory value with no conditional `WHERE attempts < 10` guard on the `UPDATE` and no `SELECT ... FOR UPDATE` row lock, creating a TOCTOU window that allows concurrent requests to bypass the 10-attempt lockout. This makes it possible for unauthenticated attackers — who know a target customer's registered email address or phone number — to fire concurrent

Defensive priority

Defenders should prioritize verifying and updating to a fixed version of the Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress, assessing exposure of customer accounts and personal data, and monitoring for suspicious authentication attempts.

Recommended defensive actions

• Verify and update to a fixed version of the Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress
• Assess exposure of customer accounts and personal data
• Monitor for suspicious authentication attempts
• Implement additional security measures to prevent brute-force attacks
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The vulnerability is caused by a non-atomic read-modify-write on the OTP verification attempts counter in the `verifyOTP` function. The CVE record and source references provide details on the affected code and potential mitigation.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.