A critical (CVSS 9.1) authentication bypass in the LatePoint appointment booking plugin, up to and including version 5.7.6, lets unauthenticated attackers reset a customer's password and take over the account.
What Is It
CVE-2026-118066 is an authentication bypass via account takeover (CWE-287) in the "Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress." Wordfence reported it and NVD published it on 2026-11-07.
The flaw is in the OsModel::build_conditions_query() function in lib/models/model.php. The function checks WHERE-clause values against the literal strings 'IS NULL' and 'IS NOT NULL'. When a value matches, it concatenates the value directly into the SQL query instead of binding it as a parameter. Neither sanitize_text_field() nor the is_scalar() hardening added in version 5.7.5 blocks this, because both let the sentinel string through unchanged.
An unauthenticated attacker can send IS NOT NULL as the password reset token to the public customer_cabinet__change_password AJAX route. The token check then stops comparing against a specific secret and matches any customer record that has a reset token set. The attacker can then set the matched customer's password to a value of their choice.
The plugin only accepts reset tokens issued within the last 15 minutes. Because the reset request flow is public, an attacker can request a password reset for a target customer, which gives that account a fresh token inside the window. The supplied records do not say which customer the query picks when more than one account has a token set, so defenders should assume any customer with a pending reset is at risk.
The same IS NOT NULL trick against the public steps__start_from_order_intent route returns the name and email from a matching order intent.
Why It Matters
- No authentication or user interaction needed. The CVSS 3.1 vector is
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, with high impact to confidentiality and integrity. - Customer data exposure. A taken-over account gives full access to the customer's bookings, orders and personal data.
- WordPress account takeover. If the
wp_users_as_customersoption is enabled, the attacker also takes over the linked WordPress subscriber or customer-role account. - Low effort. Both affected routes are public, and the description sets out the whole attack chain.
Exploitation status: CVE-2026-118066 is not in the CISA Known Exploited Vulnerabilities (KEV) catalog. The supplied data does not confirm active exploitation. NVD lists the record's status as "Deferred."
What's Vulnerable
- Vendor: latepoint
- Product: Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress
- Affected versions: all versions up to and including 5.7.6
- The 5.7.5
is_scalar()hardening does not fix this issue.
Patch Status
The supplied records give no fixed version and no vendor remediation guidance. Because every version through 5.7.6 is affected, administrators should:
- check the Wordfence advisory and the WordPress plugin changeset for a patched release;
- update to it as soon as one is available;
- until then, consider disabling the plugin on sites that store sensitive customer data.
The plugin is not in CISA KEV, so no KEV required action or due date applies.