CVE-2026-100163: CWE-287 Improper Authentication in latepoint Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress

CVE-2026-100163 describes an authentication bypass vulnerability in the LatePoint Appointment Booking Plugin for WordPress, affecting versions up to and including 5.7.2. The vulnerability occurs in the OsCustomerHelper::create_wp_user_for_customer() function, which is invoked during the public booking step process_step_customer(). When the plugin option 'Use WordPress users as customers' is enabled, the function falls back from checking email existence to checking username existence using the victim customer's email as a username. This fallback erroneously matches any WordPress user whose user_login equals the victim's email, regardless of the actual user_email field. Privileged roles are excluded, but Subscriber roles are allowed. An attacker with a Subscriber account whose user_login matches the victim's email can submit a public booking step registration request to link their account to the victim's LatePoint customer record, thereby accessing the victim's bookings, services, agents, and calendar data. Additionally, the victim's email is overwritten with the attacker's email on the victim's next login.

An attacker with at least Subscriber-level access can impersonate another LatePoint customer by exploiting this authentication bypass. This leads to unauthorized access to sensitive booking and calendar information of the victim customer. The attacker can also cause the victim's email to be overwritten, potentially disrupting communications and further compromising account integrity. The vulnerability does not affect availability but has high confidentiality and integrity impacts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should consider disabling the 'Use WordPress users as customers' option to prevent exploitation. Additionally, restricting Subscriber-level accounts or monitoring for suspicious account linkages may help mitigate risk. Follow vendor advisories for updates on patches or official fixes.