# Appointment Booking Plugin <= 5.7.4 - Unauthenticated OTP Brute Force via Race Condition in OTP Verification

- **ID:** WPSEC-2026-1166
- **Plugin:** Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress (`latepoint`), https://wordpress.org/plugins/latepoint/
- **Affected versions:** all versions before 5.7.5
- **Fixed in:** 5.7.5 (Update to 5.7.5 or later.)
- **Severity:** Medium 4.8 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N)
- **Weakness:** CWE-307
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-10-17)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/latepoint
- **Fix released:** 2026-10-16
- **Published:** 2026-10-17
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1166/

## Description

The LatePoint plugin for WordPress is vulnerable to one-time passcode brute force via the OTP verification action in all versions up to, and including, 5.7.4, due to OTP verification reading the attempts counter, checking the code and only then writing back attempts + 1 (a non-atomic update), with no per-contact or per-IP rate limiting on the public verify_otp route. This makes it possible for unauthenticated attackers to send many concurrent verification requests that go past the 10-attempt cap and guess the 6-digit code. A correct guess verifies the attacker as another customer's email address or phone number and, when customer authentication is enabled, logs them in as that customer.

Also published later by wordfence as CVE-2026-110653.

## References

- https://wpsec.com/vuln/WPSEC-2026-1166/
- https://plugins.svn.wordpress.org/latepoint/tags/5.7.5/
- https://wordpress.org/plugins/latepoint/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1166/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.