A 9.1 account takeover flaw in LatePoint

A 9.1-rated authentication bypass vulnerability was found in the LatePoint appointment and calendar plugin for WordPress. The vulnerability affects all versions up to and including 5.7.6, allowing an attacker to change a customer account’s password without logging into the site. The record was published on November 7 with the CVE-2026-118066 number; the fix came in versions 5.7.7 and 5.7.8 of the plugin.

How the vulnerability works

The flaw is in the OsModel::build_conditions_query() function at the database layer of the plugin. The function compares the values in the query with the 'IS NULL' and 'IS NOT NULL' constant texts, and when there’s a match, it inserts the value directly into the SQL query instead of binding it as a parameter. The is_scalar() check added in version 5.7.5 also doesn’t prevent this bypass in sanitize_text_field().

The practical result is this: an attacker sending customer_cabinet__change_password AJAX requests to the public params[password_reset_token]=IS NOT NULL endpoint matches the condition with all non-empty account_nonse values. The query resolves to the customer account with the lowest ID, and the password for that account is changed to a value chosen by the attacker.

The attacker can also first identify the target. When steps__start_from_order_intent is sent to the params[order_intent_key]=IS NOT NULL endpoint, the customer’s name and email address from the first matching order intent are returned. Then, a password reset is triggered for that customer, automatically opening the 15-minute freshness window needed for a password change.

Who is affected

The vulnerability concerns anyone using LatePoint for appointments, reservations, or orders on their site. Through the compromised account, an attacker can access that customer’s appointments, orders, and personal information. If the plugin’s wp_users_as_customers option is enabled, the hijacked account can also extend to the linked WordPress subscriber or customer account.

The CVSS 3.1 score is 9.1. The vector is AV:N/AC:L/PR:N/UI:N, meaning the attack can be performed over the network without requiring authentication or user interaction. The vulnerability class is CWE-287, indicating insufficient authentication. The score was given by the Wordfence team; the NVD record is still “Deferred,” meaning the analysis on the NVD side is not yet complete. There is no record of the vulnerability being actively exploited, and it is not listed in CISA’s known exploited vulnerabilities list.

What to do

The first step is to update the plugin. The latest version, 5.7.8, was released on November 3 in the WordPress.org repository; version 5.7.7 brought security hardening, and 5.7.8 closed a second security flaw. If automatic updates are disabled, you need to manually upgrade from the panel.

A quick check after updating is also beneficial. Search the access logs for requests to the customer_cabinet__change_password or steps__start_from_order_intent endpoints containing IS NOT NULL. If there are passwords that have changed on their own or unfamiliar sessions in customer accounts, reset those accounts’ passwords and inform the customers.

Source: NVD · Wordfence