# LatePoint <= 5.7.6 - Unauthenticated Authentication Bypass to Customer Account Takeover via 'password_reset_token' Parameter

- **ID:** WPSEC-2026-2337
- **Plugin:** Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress (`latepoint`), https://wordpress.org/plugins/latepoint/
- **Affected versions:** all versions before 5.7.7
- **Fixed in:** 5.7.7 (Update to 5.7.7 or later.)
- **Severity:** Medium 4.8 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N)
- **Weakness:** CWE-640
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-11-03)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/latepoint
- **Fix released:** 2026-11-02
- **Published:** 2026-11-03
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2337/

## Description

The LatePoint plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.7.6, due to insufficient validation of the 'password_reset_token' parameter in the customer cabinet password change handler. A crafted value makes the token lookup return the first customer record instead of the record that owns the token. This makes it possible for unauthenticated attackers who know that customer's email address to request a password reset for the account and set a new password without receiving the reset email, taking over the customer account and, on sites with the 'Use WordPress users as customers' option enabled, a linked subscriber-level WordPress account.

## References

- https://wpsec.com/vuln/WPSEC-2026-2337/
- https://plugins.svn.wordpress.org/latepoint/tags/5.7.7/
- https://wordpress.org/plugins/latepoint/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2337/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.