CVE-2026-110653

9.1Critical

Published 17 Oct 2026 · NVD status: Received · AI triage by gemini-3.8-flash

9.1Critical

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None
Impact: High impact on confidentiality, integrity
Weakness: CWE-287

Impact

Unauthenticated remote attackers can take over customer accounts and access their personal booking data. They only need network access and the target customer's email address or phone number to brute-force the OTP.

Root cause

A race condition during OTP verification allows concurrent requests to bypass the 10-attempt lockout due to a non-atomic read-modify-write on the attempt counter.

Affected systems

Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin up to and including version 5.7.4

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Fix & remediation

Upgrade the LatePoint plugin to version 5.7.5 or later. If updating immediately is not possible, disable the plugin or restrict access to the auth__verify_otp endpoint.

shell

$ wp plugin update latepoint --version=5.7.5

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Authentication Bypass via Race Condition in all versions up to, and including, 5.7.4. This is due to a non-atomic read-modify-write on the OTP verification attempts counter in the `verifyOTP` function: the counter is incremented using a stale in-memory value with no conditional `WHERE attempts < 10` guard on the `UPDATE` and no `SELECT ... FOR UPDATE` row lock, creating a TOCTOU window that allows concurrent requests to bypass the 10-attempt lockout. This makes it possible for unauthenticated attackers — who know a target customer's registered email address or phone number — to fire concurrent requests to the `auth__verify_otp` endpoint, defeat the lockout cap, brute-force the 6-digit OTP code, and authenticate as the targeted LatePoint customer, gaining full access to their account, bookings, and personal data. The nonce check present on the endpoint (`otp_verify_otp_nonce`) does not mitigate this issue, as the nonce is publicly emitted by the unauthenticated `request_otp` and `resend_otp` endpoints and is trivially obtainable by any unauthenticated attacker prior to launching the race.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-110653