CVE-2026-110653: CWE-287 Improper Authentication in latepoint Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress

CVE-2026-110653 describes an authentication bypass vulnerability in the LatePoint Appointment Booking Plugin for WordPress, present in versions up to 5.7.4. The issue arises from a non-atomic read-modify-write operation on the OTP verification attempts counter within the `verifyOTP` function. Specifically, the counter is incremented without a conditional WHERE clause limiting attempts to less than 10 and without row-level locking (`SELECT ... FOR UPDATE`), creating a time-of-check to time-of-use (TOCTOU) race condition. This allows unauthenticated attackers to send concurrent requests to the `auth__verify_otp` endpoint, circumvent the 10-attempt lockout, brute-force the 6-digit OTP, and authenticate as the targeted user. The nonce check on the endpoint is ineffective because the nonce is publicly available from unauthenticated endpoints, enabling attackers to obtain it easily before launching the attack.

Successful exploitation allows unauthenticated attackers to bypass OTP attempt limits and brute-force the OTP code, resulting in full account takeover of targeted LatePoint customers. Attackers gain access to user accounts, bookings, and personal data, leading to a high confidentiality and integrity impact. Availability is not affected.

No explicit patch or fix link is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider restricting access to the affected endpoints or implementing additional rate limiting and monitoring to detect concurrent OTP verification attempts. Avoid relying solely on the nonce mechanism for protection as it is publicly accessible.