Key points
- CVE-2026-110653 affects LatePoint versions up to 5.7.4 and allows unauthenticated account takeover.
- The vulnerability is a race condition that bypasses the ten-attempt OTP lockout mechanism.
- Attackers can brute-force six-digit codes by firing concurrent requests to the verification endpoint.
The short version
- The Appointment Booking Plugin for WordPress has a critical authentication bypass flaw.
- Concurrent requests exploit a non-atomic counter update to defeat login attempt limits.
- Unauthenticated users can take over customer accounts if they know the email or phone number.
The details
The National Vulnerability Database lists CVE-2026-110653 as a critical issue with a CVSS score of 9.1. This flaw exists in the Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress. It affects all versions up to and including 5.7.4. The vulnerability is classified under CWE-287, indicating an authentication bypass due to a weak implementation.
The root cause is a race condition in the `verifyOTP` function. The plugin uses a non-atomic read-modify-write operation on the OTP verification attempts counter. The counter is incremented using a stale in-memory value. There is no conditional guard on the database update to check if attempts are less than ten. Additionally, the code lacks a row lock during the selection process.
This creates a time-of-check to time-of-use window. An unauthenticated attacker who knows a target customer’s registered email address or phone number can exploit this. They can fire concurrent requests to the `auth__verify_otp` endpoint. These simultaneous requests bypass the ten-attempt lockout cap. The attacker can then brute-force the six-digit one-time password code to authenticate as the targeted customer.
The plugin’s existing nonce check does not mitigate this issue. The `otp_verify_otp_nonce` is publicly emitted by the unauthenticated `request_otp` and `resend_otp` endpoints. An attacker can obtain this nonce trivially before launching the race condition attack. Successful exploitation grants full access to the customer’s account, including their bookings and personal data.
The context
This type of race condition is distinct from simple credential stuffing because it manipulates the timing of state changes. As TechSec Headlines reported on 2026-10-12, Huntress researchers identified active exploitation of unpatched flaws in AhsayCBS for mining and webshells. That incident highlighted the risk of unpatched authentication issues in widely used tools.
LatePoint is commonly used by service providers and businesses for scheduling appointments. The ability to bypass the lockout mechanism means that account security relies entirely on the secrecy of the OTP, which is only six digits long. This significantly reduces the effort required for an attacker to gain unauthorized access compared to systems with stronger rate limiting.
What to watch
Organizations should monitor for unusual login patterns, particularly multiple failed attempts followed by a successful login from a different IP address. Review access logs for the `auth__verify_otp` endpoint for spikes in concurrent requests. Watch for customer complaints regarding unauthorized booking changes or data access.
Check if the vendor has released a patch for versions after 5.7.4. Until a fix is confirmed, consider implementing additional server-side rate limiting for the authentication endpoints. Monitor for any public exploits or proof-of-concept code related to CVE-2026-110653.
What it means for organisations
Teams responsible for digital scheduling tools should assess their exposure to authentication bypass risks. Operations leaders need to understand how plugin vulnerabilities impact customer trust and data privacy. Suppliers of these tools must be evaluated for their response times to critical security flaws. Security teams should review current monitoring capabilities for detecting race condition attacks. Incident response plans must account for account takeover scenarios involving third-party plugins.
Background: WordPress plugin vulnerabilities
Isolate the affected server immediately to stop data exfiltration. Do not delete the vulnerable plugin yet, as this destroys forensic evidence. Restore from a verified clean backup taken before the breach. Audit all user accounts for unauthorized privilege escalation. Implement strict input validation to prevent similar injection attacks in the future.
Read the full guide: WordPress Plugin Vulnerability Response and Recovery Steps
What to do and how to stay safe: LatePoint
- Check the version of the LatePoint plugin installed on your WordPress site and verify if it is 5.7.4 or earlier.
- Monitor authentication logs for concurrent requests to OTP verification endpoints that may indicate a race condition attack.
- Implement additional server-side rate limiting for login and verification endpoints to mitigate brute-force attempts.
- Notify customers who may have had their accounts accessed if evidence of exploitation is found, and force password resets.
Step-by-step guide: Automatic Software Updates: Definition, Mechanics and Hidden Risks
General security guidance from the TechSec Headlines newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of LatePoint are vulnerable to CVE-2026-110653?
All versions of the Appointment Booking Plugin – LatePoint up to and including 5.7.4 are vulnerable.
Can an attacker exploit this flaw without knowing a password?
Yes, an unauthenticated attacker can bypass the OTP lockout and brute-force the six-digit code to take over an account.
Does the nonce check prevent this attack?
No, the nonce is publicly available via unauthenticated endpoints, allowing attackers to obtain it before launching the race condition attack.
