CVE-2026-100163: Appointment Booking Plugin <= 5.7.2 - Unauthenticated Authentication Bypass to Customer Account Takeover via Insufficient Verification in create_wp_user_for_customer() username_exists Fallback
The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 5.7.2 via the OsCustomerHelper::createwpuserforcustomer() helper reached from the public processstepcustomer() booking step. When the 'Use WordPress users as customers' option is enabled, the helper falls back from emailexists() to usernameexists( $customer->email ), which matches any WordPress user whose userlogin equals the victim customer's email even when that user's useremail is completely different, and links that WordPress user's ID into the victim's LatePoint customer row (only privileged roles are excluded; Subscriber is allowed). This makes it possible for authenticated attackers, with Subscriber-level access and above, to take over another customer's LatePoint account — accessing their bookings, service, agent, and calendar data, and having the victim customer's email overwritten with the attacker's on next login — by holding a Subscriber account whose userlogin equals the victim's email and submitting an unauthenticated public booking step registration request.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using versions up to and including 5.7.2 are exposed when the "Use WordPress users as customers" option is enabled. The affected flow is the public customer step of booking.
What does an attacker need to exploit this?
The attacker needs a WordPress account with at least Subscriber-level access and a user_login set to the target customer's email address. They must then submit the public booking-step registration request; privileged WordPress roles are excluded from the vulnerable linking behavior.
What is the impact after a successful takeover?
An attacker can take over the target's LatePoint customer account and access its bookings, service, agent, and calendar data. On the victim's next login, the customer email can be overwritten with the attacker's email.
What can be done if updating is not immediately possible?
Disable the "Use WordPress users as customers" option to avoid the affected account-linking path. Also review Subscriber and other non-privileged accounts for user_login values that match customer email addresses.