Authentication Bypass Vulnerability in LatePoint Appointment Booking Plugin for WordPress

CVE-2026-118066

What is CVE-2026-118066?

The LatePoint Appointment Booking Plugin for WordPress contains an authentication bypass vulnerability that allows unauthenticated users to gain unauthorized access to customer accounts. This issue arises from faulty SQL query handling in the build_conditions_query() function, where comparison values are improperly treated as literals and concatenated directly into SQL. As a result, attackers can exploit the public AJAX routes to manipulate functions, allowing them to reset passwords and access sensitive user information. Specifically, they can initiate a password reset for target accounts by first identifying customer emails through order intents, furthering the potential for account takeover. It is crucial for users of this plugin to update to the latest version to mitigate these risks.

References