Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-110653— Appointment Booking Plugin <= 5.7.4 - Unauthenticated Authentication Bypass via Race Condition on OTP Attempts Counter

Quick assessment

Affected
latepoint Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

WordPress 插件"Appointment Booking Plugin – LatePoint 因此，未认证的攻击者只要知晓目标客户已注册的电子邮件地址或电话号码，即可向 接口发起并发请求，突破锁定次数上限，对 6 位数的 OTP 验证码进行暴力破解，从而以目标 LatePoint 客户的身份完成身份验证。攻击者借此可获得对该客户账户、预约信息及个人数据的完全访问权限。 尽管该接口存在 令牌（nonce）检查机制，但无法缓解此问题，因为该 nonce 会通过未认证的 和 接口公开返回，任何未认证的攻击者均可

CVSS 9.1 · Critical
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-110653

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Appointment Booking Plugin <= 5.7.4 - Unauthenticated Authentication Bypass via Race Condition on OTP Attempts Counter
Source: CVE Program / CVE List V5
Vulnerability Description
The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Authentication Bypass via Race Condition in all versions up to, and including, 5.7.4. This is due to a non-atomic read-modify-write on the OTP verification attempts counter in the `verifyOTP` function: the counter is incremented using a stale in-memory value with no conditional `WHERE attempts < 10` guard on the `UPDATE` and no `SELECT ... FOR UPDATE` row lock, creating a TOCTOU window that allows concurrent requests to bypass the 10-attempt lockout. This makes it possible for unauthenticated attackers — who know a target customer's registered email address or phone number — to fire concurrent requests to the `auth__verify_otp` endpoint, defeat the lockout cap, brute-force the 6-digit OTP code, and authenticate as the targeted LatePoint customer, gaining full access to their account, bookings, and personal data. The nonce check present on the endpoint (`otp_verify_otp_nonce`) does not mitigate this issue, as the nonce is publicly emitted by the unauthenticated `request_otp` and `resend_otp` endpoints and is trivially obtainable by any unauthenticated attacker prior to launching the race.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
认证机制不恰当
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
latepoint Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress 0 ~ 5.7.4 -

II. Public POCs for CVE-2026-110653

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-110653

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-110653 (1)

Vendor Pages for CVE-2026-110653 (1)

Other References for CVE-2026-110653 (4)

IV. Related Vulnerabilities

Same product: Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress
Same vendor: latepoint
Same weakness: CWE-287

V. Comments for CVE-2026-110653

No comments yet

Leave a comment