Key points
- The flaw affects all LatePoint Appointment Booking Plugin versions up to and including 5.7.4.
- Concurrent requests allow attackers to defeat the 10-attempt OTP lockout mechanism.
- Successful exploitation grants full access to targeted customer accounts and booking data.
The Appointment Booking Plugin for WordPress, known as LatePoint, contains a critical authentication bypass vulnerability affecting versions through 5.7.4. National Vulnerability Database records classify the issue as critical with a CVSS score of 9.1. The flaw stems from a race condition in how the plugin handles one-time password verification attempts. Attackers who know a user's email or phone number can exploit this gap to take over accounts without valid credentials.
In plain English
The plugin limits login attempts to ten before locking out the account, intended to prevent brute-force attacks. However, the system fails to process these attempts atomically. When multiple requests arrive simultaneously, the plugin uses an outdated count of previous failures. This time-of-check-to-time-of-use error allows attackers to send many requests at once, effectively resetting the failure counter. They can then guess the six-digit code repeatedly until it succeeds, bypassing the security lockout.
The background
The vulnerability involves the `verifyOTP` function, which increments an attempt counter using a stale in-memory value. There is no conditional guard on the database update, nor is there a row lock during the selection process. This creates a window where concurrent requests bypass the ten-attempt limit. The endpoint's nonce check does not mitigate the risk because the nonce is publicly emitted by unauthenticated endpoints. Attackers can easily obtain it before launching the race condition attack.
What changes now
Sites running LatePoint versions 5.7.4 or older are exposed to unauthenticated account takeovers. This publication reported on a similar unauthenticated flaw in the Printcart Store Plugin on 2026-10-14. This specific issue allows full access to bookings and personal data once the OTP is brute-forced. The lack of proper database locking means the lockout mechanism is ineffective against coordinated concurrent requests targeting known customer credentials.
Who needs to act first
Teams should prioritize systems with public-facing booking forms and high-value customer data. Check whether external scanners have probed your OTP endpoints recently. Isolate affected environments if possible to limit exposure while investigating. Review access logs for unusual volumes of verification requests from single sources. Coordinate with development teams to validate any interim mitigation strategies. Ensure backup procedures are current before making configuration changes. Monitor for signs of unauthorized account access immediately.
Background: Authentication bypass vulnerabilities
Enforce server-side session validation for every request. Use short-lived tokens with strict scope. Implement multi-factor authentication to block credential theft. Remove client-side logic that makes access decisions. Audit your code for logic flaws that skip verification steps.
Read the full guide: Stop Authentication Bypass Vulnerabilities with Priority Controls
What to do and how to stay safe: LatePoint
- Verify the installed version of the LatePoint Appointment Booking Plugin and compare it against the affected range.
- Monitor server logs for high frequencies of requests to the `auth__verify_otp` endpoint from unknown sources.
- Implement rate limiting at the web application firewall level for authentication endpoints if no vendor fix is available.
- Review account access patterns for anomalies that might indicate successful brute-force attempts or unauthorized logins.
Step-by-step guide: 7 Configuration Errors That Expose Systems to Zero-Day Exploits
General security guidance from the Vuln Post newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of the LatePoint plugin are affected?
All versions of the Appointment Booking Plugin up to and including version 5.7.4 are vulnerable.
Does the nonce check protect against this attack?
No, the nonce is publicly emitted by unauthenticated endpoints and is trivially obtainable by attackers.
What is the CVSS score for this vulnerability?
The National Vulnerability Database assigns a CVSS score of 9.1, classifying it as critical.
