{"id":40716,"date":"2026-10-17T12:32:59","date_gmt":"2026-10-17T04:32:59","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-110653"},"modified":"2026-10-17T12:32:59","modified_gmt":"2026-10-17T04:32:59","slug":"cve-2026-110653","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-110653","title":{"rendered":"CVE-2026-110653 [CRITICAL] &#8211; The Appointment Booking Plugin \u2013 LatePoint | Calendar &amp; Scheduling for WordPress plugin fo"},"content":{"rendered":"<p>The Appointment Booking Plugin \u2013 LatePoint | Calendar &amp; Scheduling for WordPress plugin for WordPress is vulnerable to Authentication Bypass via Race Condition in all versions up to, and including, 5.7.4. This is due to a non-atomic read-modify-write on the OTP verification attempts counter in the `verifyOTP` function: the counter is incremented using a stale in-memory value with no conditional `WHERE attempts &lt; 10` guard on the `UPDATE` and no `SELECT &#8230; FOR UPDATE` row lock, creating a TOCTOU window that allows concurrent requests to bypass the 10-attempt lockout. This makes it possible for unauthenticated attackers \u2014 who know a target customer&#039;s registered email address or phone number \u2014 to fire concurrent requests to the `auth__verify_otp` endpoint, defeat the lockout cap, brute-force the 6-digit OTP code, and authenticate as the targeted LatePoint customer, gaining full access to their account, bookings, and personal data. The nonce check present on the endpoint (`otp_verify_otp_nonce`) does not mitigate this issue, as the nonce is publicly emitted by the unauthenticated `request_otp` and `resend_otp` endpoints and is trivially obtainable by any unauthenticated attacker prior to launching the race.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>The Appointment Booking Plugin \u2013 LatePoint | Calendar &amp; Scheduling for WordPress plugin for WordPress is vulnerable to Authentication Bypass via Race Condition in all versions up to, and including, 5.<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-40716","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/40716","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=40716"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=40716"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=40716"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}