CVE-2026-100163

7.4High

Published 14 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

7.4High

Attack vector: Network
Complexity: High
Privileges needed: None
User interaction: None
Impact: High impact on confidentiality, integrity
Weakness: CWE-287

Impact

Authenticated attackers with at least a Subscriber account can take over another customer's LatePoint booking account and read or overwrite their booking and profile data. To execute this, the attacker must hold an account where their username matches the victim's email address and submit a public booking step registration.

Root cause

The OsCustomerHelper::create_wp_user_for_customer() function incorrectly falls back to checking username_exists() using the customer's email, linking the LatePoint customer record to an unrelated user account sharing that username.

Affected systems

Appointment Booking Plugin – LatePoint plugin for WordPress versions up to and including 5.7.2

CVSS v3.1 · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Fix & remediation

Upgrade the LatePoint plugin to version 5.7.3 or later. If you cannot patch immediately, disable the 'Use WordPress users as customers' setting in the plugin configuration.

shell

$ wp plugin update latepoint

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 5.7.2 via the OsCustomerHelper::create_wp_user_for_customer() helper reached from the public process_step_customer() booking step. When the 'Use WordPress users as customers' option is enabled, the helper falls back from email_exists() to username_exists( $customer->email ), which matches any WordPress user whose user_login equals the victim customer's email even when that user's user_email is completely different, and links that WordPress user's ID into the victim's LatePoint customer row (only privileged roles are excluded; Subscriber is allowed). This makes it possible for authenticated attackers, with Subscriber-level access and above, to take over another customer's LatePoint account — accessing their bookings, service, agent, and calendar data, and having the victim customer's email overwritten with the attacker's on next login — by holding a Subscriber account whose user_login equals the victim's email and submitting an unauthenticated public booking step registration request.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-100163