Appointment Booking Plugin <= 5.7.4 - Unauthenticated OTP Brute Force via Race Condition in OTP Verification
- ID
- WPSEC-2026-1166
- Plugin
- Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress (latepoint)
- Affected
- all versions before 5.7.5
- Remediation
- Update to 5.7.5 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
- Weakness
- CWE-307
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-16
- Attack surface
- Appointment Booking Plugin on WPSec AttackSurface
- Fix released
- Published
Also published later by Wordfence as CVE-2026-110653, on 2026-10-16.
Description
The LatePoint plugin for WordPress is vulnerable to one-time passcode brute force via the OTP verification action in all versions up to, and including, 5.7.4, due to OTP verification reading the attempts counter, checking the code and only then writing back attempts + 1 (a non-atomic update), with no per-contact or per-IP rate limiting on the public verify_otp route. This makes it possible for unauthenticated attackers to send many concurrent verification requests that go past the 10-attempt cap and guess the 6-digit code. A correct guess verifies the attacker as another customer's email address or phone number and, when customer authentication is enabled, logs them in as that customer.
References
- https://wpsec.com/vuln/WPSEC-2026-1166/
- https://plugins.svn.wordpress.org/latepoint/tags/5.7.5/
- https://wordpress.org/plugins/latepoint/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS