CVE-2026-110653 Appointment Booking Plugin <= 5.7.4 - Unauthenticated Authentication Bypass via Race Condition on OTP Attempts Counter
Unauthenticated attackers can bypass OTP lockouts via race conditions to brute-force codes and take over customer accounts in the LatePoint WordPress plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-110653?
CVE-2026-110653 is a critical vulnerability in Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress, published on 17 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Authentication Bypass via Race Condition in all versions up to, and including, 5.7.4. This is due to a non-atomic read-modify-write on the OTP verification attempts counter in the `verifyOTP` function: the counter is incremented using a stale in-memory value with no conditional `WHERE attempts < 10` guard on the `UPDATE` and no `SELECT ... FOR UPDATE` row lock, creating a TOCTOU window that allows concurrent requests to bypass the 10-attempt lockout. This makes it possible for unauthenticated attackers — who know a target customer's registered email address or phone number — to fire concurrent requests to the `auth__verify_otp` endpoint, defeat the lockout cap, brute-force the 6-digit OTP code, and authenticate as the targeted LatePoint customer, gaining full access to their account, bookings, and personal data. The nonce check present on the endpoint (`otp_verify_otp_nonce`) does not mitigate this issue, as the nonce is publicly emitted by the unauthenticated `request_otp` and `resend_otp` endpoints and is trivially obtainable by any unauthenticated attacker prior to launching the race.
Weakness: CWE-287
Which versions are affected by CVE-2026-110653?
How do I fix CVE-2026-110653?
No fix has been published for CVE-2026-110653 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-110653 being exploited?
There is no known exploitation of CVE-2026-110653 in the wild and no public exploit code.
Sources
Also known as GHSA-3xwr-ghgc-2994.