Authentication Bypass in LatePoint Booking Plugin for WordPress
CVE-2026-100163

7.4HIGH

Key Information:

Vendor

WordPress
Status
Appointment Booking Plugin – Latepoint | Calendar & Scheduling For WordPress
Vendor
CVE Published:
14 October 2026

What is CVE-2026-100163?

The LatePoint Booking Plugin for WordPress allows for an authentication bypass in versions up to 5.7.2 due to improper handling of user identification. When the 'Use WordPress users as customers' option is enabled, the plugin incorrectly falls back to username checks based on customer email addresses. This flaw allows authenticated users with Subscriber-level access or above to take over other customers' LatePoint accounts by matching their login names to victim email addresses, leading to unauthorized access to bookings, agent information, and calendar data.

Affected Version(s)

Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress 0 <= 5.7.2

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/latepoint/tags...
https://plugins.trac.wordpress.org/browser/latepoint/tags...

CVSS V3.1

Score:
7.4
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

OKISO
.