{"metadata": {"vulnerability": "CVE-2026-110653", "count": 24, "kinds": {"milestone": 4, "sighting": 10, "kev": 0, "other": 10}}, "data": [{"timestamp": "2026-10-14T13:08:07.307Z", "date_only": false, "value": "2026-10-14T13:08:07.307Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-110653", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-14T13:23:22Z", "date_only": false, "value": "2026-10-14T13:23:22.000Z", "kind": "other", "label": "Time", "source": "cvelistv5 / Wordfence", "record": "CVE-2026-110653", "field": "containers.cna.timeline.0.time"}, {"timestamp": "2026-10-16T14:24:52Z", "date_only": false, "value": "2026-10-16T14:24:52.000Z", "kind": "other", "label": "Time", "source": "cvelistv5 / Wordfence", "record": "CVE-2026-110653", "field": "containers.cna.timeline.1.time"}, {"timestamp": "2026-10-17T02:31:06.697Z", "date_only": false, "value": "2026-10-17T02:31:06.697Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-110653", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-17T02:31:06.697Z", "date_only": false, "value": "2026-10-17T02:31:06.697Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / Wordfence", "record": "CVE-2026-110653", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-17T02:52:13.846Z", "date_only": false, "value": "2026-10-17T02:52:13.846627Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117453981829157536", "record": "CVE-2026-110653", "field": "creation_timestamp", "uuid": "63043131-b98a-440b-a8a2-8dd521f4dfce", "content": "CVE-2026-110653 Appointment Booking Plugin <= 5.7.4 - Unauthenticated Authentication Bypass via Race Condition on OTP Attempts Counter The Appointment Booking Plugin \u2013 LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Authentication Bypass via Race Condition in all versions up to, and including, 5.7.4. This is due to a non-atomic read-modify-write on the OTP verification attempts counter in the `verifyOTP` function: the counter is incremented using a stale in-memory value with no conditional `WHERE attempts < 10` guard on the `UPDATE` and no `SELECT ... FOR UPDATE` row lock, creating a TOCTOU window that allows concurrent requests to bypass the 10-attempt lockout. This makes it possible for unauthenticated attackers \u2014 who know a target customer's registered email address or phone number \u2014 to fire concurrent requests to the `auth__verify_otp` endpoint, defeat the lockout cap, brute-force the 6-digit OTP code, and authenticate as the targeted LatePoint customer, gaining full access to their account, bookings, and personal data. The nonce check present on the endpoint (`otp_verify_otp_nonce`) does not mitigate this issue, as the nonce is publicly emitted by the unauthenticated `request_otp` and `resend_otp` endpoints and is trivially obtainable by any unauthenticated attacker prior to launching the race.\nhttps://www.cve.org/CVERecord?id=CVE-2026-110653https://www.wordfence.com/threat-intel/vulnerabilities/id/61fbc1dd-06c9-409b-8cad-3f350b38dfc3?source=cvehttps://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.4/lib/helpers/otp_helper.php#L228https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.4/lib/helpers/otp_helper.php#L185https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.4/lib/controllers/auth_controller.php#L30https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.4/lib/controllers/auth_controller.php#L14https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.4/lib/models/model.php#L773https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.5/lib/helpers/otp_helper.php#wordpress #latepoint #AppointmentBookingPlugin\u2013LatePoint|Calendar&SchedulingforWordPress#CVE_2026_110653#bot", "url": "https://infosec.exchange/users/cve/statuses/117453981829157536"}, {"timestamp": "2026-10-17T03:14:37.180Z", "date_only": false, "value": "2026-10-17T03:14:37.180236Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/suriq.io/post/3my24r4ylax24", "record": "CVE-2026-110653", "field": "creation_timestamp", "uuid": "7520dfa8-1f25-4ba5-9156-1f6a8d07de3a", "content": "\u26a0\ufe0f PATCH NOW\n\nLatePoint, the WordPress booking plugin, has a critical account-takeover flaw.\n\nCVE-2026-110653 (CVSS 9.1): send login-code guesses all at once and the ten-try lockout never trips. Fixed in 5.7.5. Update now.", "url": "https://bsky.app/profile/suriq.io/post/3my24r4ylax24"}, {"timestamp": "2026-10-17T03:16:28Z", "date_only": false, "value": "2026-10-17T03:16:28Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-3XWR-GHGC-2994", "record": "GHSA-3XWR-GHGC-2994", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-17T03:16:28.480Z", "date_only": false, "value": "2026-10-17T03:16:28.480", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-110653", "record": "FKIE_CVE-2026-110653", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-17T03:30:21Z", "date_only": false, "value": "2026-10-17T03:30:21Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-3XWR-GHGC-2994", "record": "GHSA-3XWR-GHGC-2994", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-17T03:30:21Z", "date_only": false, "value": "2026-10-17T03:30:21Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-3XWR-GHGC-2994", "record": "GHSA-3XWR-GHGC-2994", "field": "modified"}, {"timestamp": "2026-10-17T03:56:18.609Z", "date_only": false, "value": "2026-10-17T03:56:18.609072Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/bxh7g63gnp2qb", "record": "CVE-2026-110653", "field": "creation_timestamp", "uuid": "60d8861d-a135-42d6-8411-a9b4da50c2d6", "content": "CVE-2026-110653 - Appointment Booking Plugin\nCVE ID : CVE-2026-110653\n \n Published : Oct. 17, 2026, 3:16 a.m. | 18\u00a0minutes ago\n \n Description : The Appointment Booking Plugin \u2013 LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Authentica...", "url": "https://bsky.app/profile/cve.skyfleet.blue/post/bxh7g63gnp2qb"}, {"timestamp": "2026-10-17T04:07:20.039Z", "date_only": false, "value": "2026-10-17T04:07:20.039068Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3my27pgb3qh2o", "record": "CVE-2026-110653", "field": "creation_timestamp", "uuid": "1c03a783-913a-477b-bcea-4b35c4b69a3f", "content": "\ud83d\udea8 CVE-2026-110653 \u2014 CVSS 9.1 CRITICAL\n\nThe Appointment Booking Plugin \u2013 LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vu...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-110653\n\n#CVE #CyberSecurity #InfoSec", "url": "https://bsky.app/profile/stemshop.bsky.social/post/3my27pgb3qh2o"}, {"timestamp": "2026-10-17T04:20:04.434Z", "date_only": false, "value": "2026-10-17T04:20:04.434753Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3my2ag6eh772r", "record": "CVE-2026-110653", "field": "creation_timestamp", "uuid": "9a9d3409-6277-4b74-bc9c-da4746eb06f8", "content": "CVE-2026-110653 - appointment booking plugin \u2013 latepoint | calendar & scheduling for wordpress\nThe LatePoint appointment scheduling plugin for WordPress allows anyone who knows a user\u2019s email or phone number to\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#latepoint #CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3my2ag6eh772r"}, {"timestamp": "2026-10-17T06:00:27.124Z", "date_only": false, "value": "2026-10-17T06:00:27.124574Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/offseq/statuses/117454721934548658", "record": "cve-2026-110653", "field": "creation_timestamp", "uuid": "27bd5727-47f2-411c-9f12-50fabeb93c51", "content": "CVE-2026-110653 | CRITICAL flaw in LatePoint Appointment Booking Plugin (<=5.7.4) for WordPress: Race condition in OTP lets attackers bypass authentication & seize user accounts. Restrict OTP endpoints, monitor now. https://radar.offseq.com/threat/cve-2026-110653-cwe-287-improper-authentication-in-latepoint-appointment-booking-plugin-latepoint-084a535b1718f8eb #OffSeq #WordPress #CVE2026110653", "url": "https://infosec.exchange/users/offseq/statuses/117454721934548658"}, {"timestamp": "2026-10-17T06:00:29.204Z", "date_only": false, "value": "2026-10-17T06:00:29.204951Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3my2fzq6dn72r", "record": "cve-2026-110653", "field": "creation_timestamp", "uuid": "c9faae38-4f3e-446b-95e1-0d063daf24cd", "content": "LatePoint Booking Plugin (<=5.7.4) hit by CRITICAL CWE-287 bug: OTP race condition enables account takeover on WordPress. Restrict/monitor OTP endpoints now until patch. https://radar.offseq.com/threat/cve-2026-110653-cwe-287-improper-authentication-in-latepoint-appointment-booking-plugin-latepoi...", "url": "https://bsky.app/profile/offseq.bsky.social/post/3my2fzq6dn72r"}, {"timestamp": "2026-10-17T08:20:18.942Z", "date_only": false, "value": "2026-10-17T08:20:18.942095Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3my2ntrkwsf2y", "record": "CVE-2026-110653", "field": "creation_timestamp", "uuid": "8db4b573-f0c1-495c-89c7-bb7d453350da", "content": "\ud83d\udd34 CVE-2026-110653 - Critical (9.1)\n\nThe Appointment Booking Plugin \u2013 LatePoint | Calendar & Scheduling for WordPress plugin for Wor...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-110653/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "url": "https://bsky.app/profile/thehackerwire.bsky.social/post/3my2ntrkwsf2y"}, {"timestamp": "2026-10-17T10:01:51.595Z", "date_only": false, "value": "2026-10-17T10:01:51.595020Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/undercode.bsky.social/post/3my2tjdl6r224", "record": "CVE-2026-110653", "field": "creation_timestamp", "uuid": "9869f135-d006-4859-b5ce-5b58522219dc", "content": "Critical CVE-2026-104736 and CVE-2026-110653: Unauthenticated Flaws in LearnPress and LatePoint Threatening WordPress Deployments +\u00a0Video\n\nIntroduction: Recent threat intelligence highlights two critical, unauthenticated vulnerabilities affecting widely used WordPress plugins\u2014LearnPress\u2026", "url": "https://bsky.app/profile/undercode.bsky.social/post/3my2tjdl6r224"}, {"timestamp": "2026-10-18T11:09:42.337Z", "date_only": false, "value": "2026-10-18T11:09:42.337028Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-110653", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-10-18T11:09:42.337Z", "date_only": false, "value": "2026-10-18T11:09:42.337028Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-110653", "record": "FKIE_CVE-2026-110653", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-10-18T11:22:47.841Z", "date_only": false, "value": "2026-10-18T11:22:47.841Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-110653", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-18T11:22:47.841Z", "date_only": false, "value": "2026-10-18T11:22:47.841Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-110653", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-19T00:00:14.564Z", "date_only": false, "value": "2026-10-19T00:00:14.564378Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/pulse-wp.com/post/3my6stfr6j32p", "record": "CVE-2026-110653", "field": "creation_timestamp", "uuid": "bafcf2cc-4166-4aa5-8d0e-72f656e44631", "content": "Attackers bypass OTP verification. They hijack user accounts without a password. CVE-2026-110653 / 9.1 CVSS. Appointment Booking Plugin \u2013 LatePoint up to 5.7.4 is vulnerable. Update now. Scan your WordPress site: pulse-wp.com\n#WordPress #CVE #CyberSecurity", "url": "https://bsky.app/profile/pulse-wp.com/post/3my6stfr6j32p"}, {"timestamp": "2026-10-19T15:16:45.150Z", "date_only": false, "value": "2026-10-19T15:16:45.150", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-110653", "record": "FKIE_CVE-2026-110653", "field": "lastModified"}], "metrics": {"as_of": "2026-11-01T22:49:37.166Z", "anchors": {"origin": {"timestamp": "2026-10-17T02:31:06.697Z", "date_only": false, "value": "2026-10-17T02:31:06.697Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-110653", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-10-17T02:31:06.697Z", "date_only": false, "value": "2026-10-17T02:31:06.697Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-110653", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 1369110.469177, "hours": 380.30846366027777, "days": 15.846185985844908, "min_seconds": 1369110.469177, "max_seconds": 1369110.469177, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-10-17T02:31:06.697Z", "date_only": false, "value": "2026-10-17T02:31:06.697Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-110653", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-01T22:49:37.166Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}