{"vulnerability": "CVE-2026-110653", "sightings": [{"uuid": "63043131-b98a-440b-a8a2-8dd521f4dfce", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-110653", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117453981829157536", "content": "CVE-2026-110653 Appointment Booking Plugin <= 5.7.4 - Unauthenticated Authentication Bypass via Race Condition on OTP Attempts Counter The Appointment Booking Plugin \u2013 LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Authentication Bypass via Race Condition in all versions up to, and including, 5.7.4. This is due to a non-atomic read-modify-write on the OTP verification attempts counter in the `verifyOTP` function: the counter is incremented using a stale in-memory value with no conditional `WHERE attempts < 10` guard on the `UPDATE` and no `SELECT ... FOR UPDATE` row lock, creating a TOCTOU window that allows concurrent requests to bypass the 10-attempt lockout. This makes it possible for unauthenticated attackers \u2014 who know a target customer's registered email address or phone number \u2014 to fire concurrent requests to the `auth__verify_otp` endpoint, defeat the lockout cap, brute-force the 6-digit OTP code, and authenticate as the targeted LatePoint customer, gaining full access to their account, bookings, and personal data. The nonce check present on the endpoint (`otp_verify_otp_nonce`) does not mitigate this issue, as the nonce is publicly emitted by the unauthenticated `request_otp` and `resend_otp` endpoints and is trivially obtainable by any unauthenticated attacker prior to launching the race.\nhttps://www.cve.org/CVERecord?id=CVE-2026-110653https://www.wordfence.com/threat-intel/vulnerabilities/id/61fbc1dd-06c9-409b-8cad-3f350b38dfc3?source=cvehttps://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.4/lib/helpers/otp_helper.php#L228https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.4/lib/helpers/otp_helper.php#L185https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.4/lib/controllers/auth_controller.php#L30https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.4/lib/controllers/auth_controller.php#L14https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.4/lib/models/model.php#L773https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.5/lib/helpers/otp_helper.php#wordpress #latepoint #AppointmentBookingPlugin\u2013LatePoint|Calendar&SchedulingforWordPress#CVE_2026_110653#bot", "creation_timestamp": "2026-10-17T02:52:13.846627Z"}, {"uuid": "7520dfa8-1f25-4ba5-9156-1f6a8d07de3a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-110653", "type": "seen", "source": "https://bsky.app/profile/suriq.io/post/3my24r4ylax24", "content": "\u26a0\ufe0f PATCH NOW\n\nLatePoint, the WordPress booking plugin, has a critical account-takeover flaw.\n\nCVE-2026-110653 (CVSS 9.1): send login-code guesses all at once and the ten-try lockout never trips. Fixed in 5.7.5. Update now.", "creation_timestamp": "2026-10-17T03:14:37.180236Z"}, {"uuid": "60d8861d-a135-42d6-8411-a9b4da50c2d6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-110653", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/bxh7g63gnp2qb", "content": "CVE-2026-110653 - Appointment Booking Plugin\nCVE ID : CVE-2026-110653\n \n Published : Oct. 17, 2026, 3:16 a.m. | 18\u00a0minutes ago\n \n Description : The Appointment Booking Plugin \u2013 LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Authentica...", "creation_timestamp": "2026-10-17T03:56:18.609072Z"}, {"uuid": "1c03a783-913a-477b-bcea-4b35c4b69a3f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-110653", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3my27pgb3qh2o", "content": "\ud83d\udea8 CVE-2026-110653 \u2014 CVSS 9.1 CRITICAL\n\nThe Appointment Booking Plugin \u2013 LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vu...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-110653\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-10-17T04:07:20.039068Z"}, {"uuid": "9a9d3409-6277-4b74-bc9c-da4746eb06f8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-110653", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3my2ag6eh772r", "content": "CVE-2026-110653 - appointment booking plugin \u2013 latepoint | calendar & scheduling for wordpress\nThe LatePoint appointment scheduling plugin for WordPress allows anyone who knows a user\u2019s email or phone number to\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#latepoint #CVE #infosec", "creation_timestamp": "2026-10-17T04:20:04.434753Z"}, {"uuid": "27bd5727-47f2-411c-9f12-50fabeb93c51", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-110653", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/117454721934548658", "content": "CVE-2026-110653 | CRITICAL flaw in LatePoint Appointment Booking Plugin (<=5.7.4) for WordPress: Race condition in OTP lets attackers bypass authentication & seize user accounts. Restrict OTP endpoints, monitor now. https://radar.offseq.com/threat/cve-2026-110653-cwe-287-improper-authentication-in-latepoint-appointment-booking-plugin-latepoint-084a535b1718f8eb #OffSeq #WordPress #CVE2026110653", "creation_timestamp": "2026-10-17T06:00:27.124574Z"}, {"uuid": "c9faae38-4f3e-446b-95e1-0d063daf24cd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-110653", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3my2fzq6dn72r", "content": "LatePoint Booking Plugin (<=5.7.4) hit by CRITICAL CWE-287 bug: OTP race condition enables account takeover on WordPress. Restrict/monitor OTP endpoints now until patch. https://radar.offseq.com/threat/cve-2026-110653-cwe-287-improper-authentication-in-latepoint-appointment-booking-plugin-latepoi...", "creation_timestamp": "2026-10-17T06:00:29.204951Z"}, {"uuid": "8db4b573-f0c1-495c-89c7-bb7d453350da", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-110653", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3my2ntrkwsf2y", "content": "\ud83d\udd34 CVE-2026-110653 - Critical (9.1)\n\nThe Appointment Booking Plugin \u2013 LatePoint | Calendar & Scheduling for WordPress plugin for Wor...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-110653/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-10-17T08:20:18.942095Z"}, {"uuid": "9869f135-d006-4859-b5ce-5b58522219dc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-110653", "type": "seen", "source": "https://bsky.app/profile/undercode.bsky.social/post/3my2tjdl6r224", "content": "Critical CVE-2026-104736 and CVE-2026-110653: Unauthenticated Flaws in LearnPress and LatePoint Threatening WordPress Deployments +\u00a0Video\n\nIntroduction: Recent threat intelligence highlights two critical, unauthenticated vulnerabilities affecting widely used WordPress plugins\u2014LearnPress\u2026", "creation_timestamp": "2026-10-17T10:01:51.595020Z"}, {"uuid": "bafcf2cc-4166-4aa5-8d0e-72f656e44631", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-110653", "type": "seen", "source": "https://bsky.app/profile/pulse-wp.com/post/3my6stfr6j32p", "content": "Attackers bypass OTP verification. They hijack user accounts without a password. CVE-2026-110653 / 9.1 CVSS. Appointment Booking Plugin \u2013 LatePoint up to 5.7.4 is vulnerable. Update now. Scan your WordPress site: pulse-wp.com\n#WordPress #CVE #CyberSecurity", "creation_timestamp": "2026-10-19T00:00:14.564378Z"}]}