CVE-2026-100163 Overview
CVE-2026-100163 is an authentication bypass vulnerability in the Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress, affecting versions up to and including 5.7.2. The flaw resides in the OsCustomerHelper::create_wp_user_for_customer() helper reached through the public process_step_customer() booking step. When the "Use WordPress users as customers" option is enabled, the helper falls back from email_exists() to username_exists( $customer->email ), matching any WordPress user whose user_login equals the victim customer's email. Authenticated attackers with Subscriber-level access can link a victim's LatePoint customer record to their own WordPress account and take over the customer's bookings, agent assignments, and calendar data. The vulnerability is tracked under [CWE-287 Improper Authentication].
Critical Impact
Subscriber-level attackers can hijack LatePoint customer accounts, access booking and calendar data, and permanently overwrite the victim's email with their own on next login.
Affected Products
- LatePoint – Appointment Booking Plugin for WordPress, versions up to and including 5.7.2
- Deployments with the "Use WordPress users as customers" option enabled
- Fixed in LatePoint version 5.7.3
Discovery Timeline
- 2026-10-14 - CVE-2026-100163 published to NVD
- 2026-10-14 - Last updated in NVD database
Technical Details for CVE-2026-100163
Vulnerability Analysis
The vulnerability stems from an unsafe fallback inside OsCustomerHelper::create_wp_user_for_customer() in lib/helpers/customer_helper.php. When LatePoint tries to associate a WordPress user with a booking customer, it first calls email_exists() against the customer email. If no match is found, the code falls back to username_exists( $customer->email ), which looks up WordPress accounts by user_login rather than by user_email.
Because WordPress allows a user's user_login to be any string, an attacker can register a Subscriber account with a user_login set to the victim's email address. On the next public booking step submitted on behalf of the victim, the helper locates the attacker's Subscriber account through the username lookup and writes that account's WordPress user ID into the victim's LatePoint customer row. The role filter only excludes privileged roles, so Subscriber accounts are accepted.
Root Cause
The root cause is improper identity verification. The helper treats username_exists() as a trusted equivalent of email_exists(), but WordPress stores user_login and user_email independently. Matching a customer email against user_login creates a cross-field confusion that collapses two distinct identifiers into one, violating the authentication boundary between WordPress users and LatePoint customers.
Attack Vector
The attacker first registers a WordPress Subscriber account whose user_login matches the target customer's email address. The attacker then submits an unauthenticated public booking step registration request through process_step_customer(), referencing the victim's email. The helper calls email_exists(), which returns false, then falls back to username_exists(), which matches the attacker's account. LatePoint links the attacker's user ID into the victim's customer row. The attacker gains access to the victim's bookings, service history, agent assignments, and calendar data, and the victim's email is overwritten with the attacker's on the next login event. Technical details are available in the Wordfence Vulnerability Report and the LatePoint Customer Helper Code.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-100163
Indicators of Compromise
- WordPress Subscriber accounts whose user_login value is formatted as an email address and matches an existing LatePoint customer email.
- LatePoint customer rows whose linked wp_user_id resolves to a WordPress user with a different user_email than the customer record.
- Unexpected changes to customer email addresses in the LatePoint customer table immediately following a Subscriber login event.
- Repeated POST requests to the LatePoint public booking step endpoint referencing emails belonging to existing customers.
Detection Strategies
- Query the WordPress wp_users table for accounts where user_login contains an @ character and cross-reference against the LatePoint customers table for matching emails.
- Audit the LatePoint customer table for rows where the linked WordPress user's user_email does not equal the customer's email field.
- Enable verbose logging on the LatePoint booking step handler and inspect sequences where a public booking submission is followed by a customer record update.
Monitoring Recommendations
- Alert on new Subscriber registrations whose user_login matches the email pattern of any existing LatePoint customer.
- Monitor web server access logs for POST requests to the booking endpoint originating from authenticated Subscriber sessions.
- Review scheduled database integrity jobs to detect divergence between LatePoint customer emails and the WordPress user accounts they are linked to.
How to Mitigate CVE-2026-100163
Immediate Actions Required
- Upgrade LatePoint to version 5.7.3 or later, which removes the unsafe username_exists() fallback. See the LatePoint Customer Helper v5.7.3 source for the corrected logic.
- Audit existing WordPress Subscriber accounts and remove or rename any whose user_login is formatted as an email and matches a LatePoint customer.
- Reconcile LatePoint customer rows against WordPress user records and reset any mismatched links discovered during the audit.
Patch Information
The vendor addressed the issue in LatePoint 5.7.3. The patched customer_helper.php no longer resolves customer identity through username_exists( $customer->email ), eliminating the cross-field lookup that enabled account linking. Administrators should apply the update through the WordPress plugin manager and confirm the installed version reflects 5.7.3 or newer.
Workarounds
- Disable the "Use WordPress users as customers" option in LatePoint settings until the plugin can be updated.
- Restrict public user registration on the WordPress site, or require administrator approval before new Subscriber accounts become active.
- Enforce a registration policy that rejects user_login values containing an @ character to prevent emails from being used as usernames.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
