CVE-2026-110653: Appointment Booking Plugin <= 5.7.4 - Unauthenticated Authentication Bypass via Race Condition on OTP Attempts Counter
The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Authentication Bypass via Race Condition in all versions up to, and including, 5.7.4. This is due to a non-atomic read-modify-write on the OTP verification attempts counter in the verifyOTP function: the counter is incremented using a stale in-memory value with no conditional WHERE attempts < 10 guard on the UPDATE and no SELECT ... FOR UPDATE row lock, creating a TOCTOU window that allows concurrent requests to bypass the 10-attempt lockout. This makes it possible for unauthenticated attackers — who know a target customer's registered email address or phone number — to fire concurrent requests to the authverifyotp endpoint, defeat the lockout cap, brute-force the 6-digit OTP code, and authenticate as the targeted LatePoint customer, gaining full access to their account, bookings, and personal data. The nonce check present on the endpoint (otpverifyotpnonce) does not mitigate this issue, as the nonce is publicly emitted by the unauthenticated requestotp and resendotp endpoints and is trivially obtainable by any unauthenticated attacker prior to launching the race.
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
An attacker needs a target LatePoint customer's registered email address or phone number. They can obtain the required OTP verification nonce through the publicly accessible unauthenticated request_otp or resend_otp endpoints, then send concurrent requests to auth__verify_otp while brute-forcing the six-digit code.
Are unauthenticated attackers able to exploit this remotely?
Yes. The issue is reachable through the auth__verify_otp endpoint without authentication, and the vulnerability is rated network-accessible with low attack complexity and no user interaction required.
What access could an attacker gain after successful exploitation?
A successful attacker can authenticate as the targeted LatePoint customer. This grants access to that customer's account, bookings, and personal data.
Which plugin versions are affected?
All LatePoint Appointment Booking Plugin versions through and including 5.7.4 are affected. The provided information does not identify a fixed version.