{
 "id": "WPSEC-2026-1166",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1166/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1166/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1166/index.md",
 "title": "Appointment Booking Plugin <= 5.7.4 - Unauthenticated OTP Brute Force via Race Condition in OTP Verification",
 "description": "The LatePoint plugin for WordPress is vulnerable to one-time passcode brute force via the OTP verification action in all versions up to, and including, 5.7.4, due to OTP verification reading the attempts counter, checking the code and only then writing back attempts + 1 (a non-atomic update), with no per-contact or per-IP rate limiting on the public verify_otp route. This makes it possible for unauthenticated attackers to send many concurrent verification requests that go past the 10-attempt cap and guess the 6-digit code. A correct guess verifies the attacker as another customer's email address or phone number and, when customer authentication is enabled, logs them in as that customer.",
 "plugin": {
  "slug": "latepoint",
  "name": "Appointment Booking Plugin",
  "full_name": "Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress",
  "wordpress_org": "https://wordpress.org/plugins/latepoint/",
  "advisories_url": "https://wpsec.com/vuln/plugin/latepoint/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/latepoint"
 },
 "type": "AUTHBYPASS",
 "cwe": [
  "CWE-307"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 4.8,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "5.7.5",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 5.7.5"
  ]
 },
 "introduced_in": null,
 "fixed_in": "5.7.5",
 "remediation": "Update to 5.7.5 or later.",
 "fix_released": "2026-10-16T05:37:10+00:00",
 "published": "2026-10-17T05:42:11+00:00",
 "updated": "2026-10-16T09:50:12.424314+00:00",
 "also_published_as": {
  "source": "wordfence",
  "cve": [
   "CVE-2026-110653"
  ],
  "published": "2026-10-16T14:24:52+00:00"
 },
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1166/",
  "https://plugins.svn.wordpress.org/latepoint/tags/5.7.5/",
  "https://wordpress.org/plugins/latepoint/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/latepoint",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-10-17"
 }
}