CVE-2026-110653: LatePoint WordPress Authentication Bypass

CVE-2026-110653 Overview

CVE-2026-110653 is an authentication bypass vulnerability in the LatePoint Appointment Booking Plugin for WordPress, affecting all versions up to and including 5.7.4. The flaw resides in the verifyOTP function, which performs a non-atomic read-modify-write on the one-time password (OTP) attempts counter. Unauthenticated attackers who know a customer's registered email address or phone number can issue concurrent requests to the auth__verify_otp endpoint, defeat the 10-attempt lockout, and brute-force the 6-digit OTP. Successful exploitation grants full access to the targeted customer's account, bookings, and personal data. The weakness is classified under [CWE-287: Improper Authentication].

Critical Impact
Unauthenticated attackers can bypass the OTP lockout cap via a race condition and brute-force any customer account knowing only an email address or phone number.

Affected Products

LatePoint – Appointment Booking Plugin for WordPress, versions up to and including 5.7.4
Calendar & Scheduling functionality shipped within the affected LatePoint releases
WordPress sites exposing the auth__verify_otp, request_otp, and resend_otp endpoints

Discovery Timeline

2026-10-17 - CVE-2026-110653 published to NVD
2026-10-19 - Last updated in NVD database

Technical Details for CVE-2026-110653

Vulnerability Analysis

The vulnerability stems from a Time-of-Check Time-of-Use (TOCTOU) race condition in the LatePoint OTP verification workflow. The verifyOTP function reads the attempts counter from the database, compares it against the maximum of 10, and then issues an UPDATE statement using a stale in-memory value. Because the UPDATE lacks a conditional WHERE attempts < 10 guard and no SELECT ... FOR UPDATE row lock is taken, parallel PHP workers can each observe a pre-lockout counter value before any of them writes.

Attackers exploit this gap by firing hundreds of concurrent HTTP requests against the auth__verify_otp endpoint. Each worker sees attempts < 10, accepts a candidate OTP, and increments independently. The lockout cap collapses, and the effective guess space shrinks to brute-forceable territory against a 6-digit code. A successful guess returns an authenticated session for the targeted LatePoint customer.

Root Cause

The root cause is an atomicity violation in the OTP attempts bookkeeping logic within lib/helpers/otp_helper.php. The read of the current counter and the subsequent write are not performed inside a single transactional, locked operation. Without row-level locking or an atomic compare-and-set in SQL, concurrent requests race the check-then-act sequence and bypass the intended rate limit.

Attack Vector

Exploitation requires network access to the WordPress site and knowledge of a registered customer's email address or phone number. The attacker first calls the unauthenticated request_otp or resend_otp endpoint, which publicly emits the otp_verify_otp_nonce token. Armed with that nonce, the attacker launches parallel POST requests to auth__verify_otp, cycling through 6-digit OTP candidates until one succeeds. The nonce check does not mitigate the issue because the token is trivially obtainable before the race begins.

No verified proof-of-concept code has been published. See the Wordfence Vulnerability Report #61fbc1dd and the vulnerable source references for the auth controller and the OTP helper for technical details.

Detection Methods for CVE-2026-110653

Indicators of Compromise

High-volume, short-duration bursts of POST requests to auth__verify_otp originating from a single source IP or small IP cluster targeting one customer identifier.
Repeated calls to request_otp or resend_otp immediately preceding bursts against auth__verify_otp.
LatePoint customer accounts showing successful OTP authentication followed by unusual session, booking, or profile activity.
Database records where the OTP attempts counter exceeds 10 for a given customer within a single verification window.

Detection Strategies

Monitor web server access logs for parallel requests to /wp-admin/admin-ajax.php or front-end routes invoking the auth__verify_otp action.
Alert when a single client sends more than a handful of OTP verification attempts per second against the same customer identifier.
Correlate successful customer logins with preceding bursts of failed OTP attempts across concurrent connections.

Monitoring Recommendations

Enable WordPress audit logging for authentication events generated by the LatePoint plugin.
Forward WordPress and web server telemetry to a centralized analytics backend to retain enough history for brute-force pattern analysis.
Instrument the reverse proxy or web application firewall (WAF) to count concurrent in-flight requests per endpoint, per source, per customer identifier.

How to Mitigate CVE-2026-110653

Immediate Actions Required

Upgrade the LatePoint plugin to version 5.7.5 or later, which rewrites the OTP attempts handling in lib/helpers/otp_helper.php.
Audit WordPress authentication and LatePoint booking logs for suspicious OTP verification bursts since the plugin was deployed.
Force a password or OTP challenge reset for any customer accounts showing anomalous access patterns.

Patch Information

The vendor released a fix in LatePoint version 5.7.5. The patched verifyOTP logic can be reviewed in the updated OTP helper for v5.7.5. WordPress administrators should apply the update through the plugin manager and confirm the installed version is 5.7.5 or newer before closing the ticket.

Workarounds

Deploy a WAF rule that rate-limits requests to the auth__verify_otp endpoint per source IP and per targeted customer identifier.
Restrict concurrent in-flight requests to the LatePoint OTP endpoints at the reverse proxy layer until the patch is applied.
Temporarily disable the LatePoint plugin on sites that cannot immediately upgrade and whose customer data is sensitive.

bash

# Example nginx rate-limit for the LatePoint OTP verification endpoint
limit_req_zone $binary_remote_addr zone=latepoint_otp:10m rate=5r/m;

location = /wp-admin/admin-ajax.php {
    if ($arg_action = "auth__verify_otp") {
        limit_req zone=latepoint_otp burst=5 nodelay;
    }
    include fastcgi_params;
    fastcgi_pass php_upstream;
}