Authentication Bypass Issue in Appointment Booking Plugin by LatePoint

CVE-2026-110653

What is CVE-2026-110653?

The Appointment Booking Plugin – LatePoint for WordPress is susceptible to an authentication bypass through a race condition. This occurs in the verifyOTP function, where a non-atomic read-modify-write process leads to a time-of-check-to-time-of-use (TOCTOU) vulnerability. With no proper safeguards in place, such as a conditional ‘WHERE attempts < 10’ clause or a row lock using SELECT … FOR UPDATE, unauthorized attackers can exploit this flaw by sending multiple concurrent requests to the auth__verify_otp endpoint. If they possess a target's registered email or phone number, they can effectively bypass the limit on OTP verification attempts, brute-forcing access to accounts and personal data. The nonce associated with the OTP process does not mitigate the vulnerability, as it is easily obtainable via other unauthenticated endpoints, leaving customers at risk.

References