A critical race condition in the LatePoint appointment booking plugin for WordPress (versions up to and including 5.7.4) could allow unauthenticated attackers to brute-force one-time passcodes and log in as any customer whose email address or phone number they know, according to the Wordfence advisory.
What Is It
CVE-2026-110653 is an authentication bypass (CWE-287) in the verifyOTP function of the Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress. The plugin tracks failed OTP attempts with a non-atomic read-modify-write. It increments the counter from a stale in-memory value. The UPDATE has no conditional WHERE attempts < 10 guard, and there is no SELECT ... FOR UPDATE row lock.
This creates a time-of-check/time-of-use (TOCTOU) window. An attacker who sends many concurrent requests to the auth__verify_otp endpoint may be able to get past the 10-attempt lockout and brute-force the 6-digit OTP code.
The endpoint's nonce check (otp_verify_otp_nonce) does not appear to block this. The unauthenticated request_otp and resend_otp endpoints reportedly hand out that nonce publicly, so an attacker could likely get it before starting the race.
Why It Matters
Wordfence rates this flaw CVSS 3.1 9.1 (CRITICAL) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. Based on that vector, it can be exploited over the network with low complexity, no privileges and no user interaction.
According to the advisory, an attacker would only need a target customer's registered email address or phone number. A successful attack could log them in as that LatePoint customer, potentially giving them access to the customer's account, bookings and personal data.
As of this writing, CVE-2026-110653 does not appear in the CISA Known Exploited Vulnerabilities catalog. KEV does not currently confirm active exploitation of this CVE, and CISA has published no required action for it.
What's Vulnerable
- Vendor: latepoint
- Product: Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress
- Affected versions: all versions up to and including 5.7.4
The NVD record is in "Received" status and lists no CPEs yet.
Patch Status
NVD lists every version through 5.7.4 as affected. One of its references points to otp_helper.php in the plugin's 5.7.5 tag, which suggests the fix is in 5.7.5. The supplied data does not explicitly confirm a fixed version. Administrators should:
- check the Wordfence advisory to confirm the fixed release
- update LatePoint past 5.7.4
Sources
- NVD – CVE-2026-110653
- Wordfence Threat Intel advisory
- CISA Known Exploited Vulnerabilities Catalog
- WordPress Trac – LatePoint 5.7.4 auth_controller.php (L14)
- WordPress Trac – LatePoint 5.7.4 auth_controller.php (L30)
- WordPress Trac – LatePoint 5.7.4 otp_helper.php (L185)
- WordPress Trac – LatePoint 5.7.4 otp_helper.php (L228)
- WordPress Trac – LatePoint 5.7.4 model.php (L773)
- WordPress Trac – LatePoint 5.7.5 otp_helper.php