SURIQ
Wordfence has disclosed a critical flaw in LatePoint, the WordPress appointment-booking plugin, that lets an unauthenticated attacker take over a customer's account. Tracked as CVE-2026-110653 and rated CVSS 9.1, the bug affects every version up to and including 5.7.4 and is fixed in 5.7.5. If you run LatePoint on a public booking site, update now.
How a race beats the login-code lockout
LatePoint can sign a customer in with a one-time password (OTP): a six-digit code sent to the email address or phone number on file. To stop attackers from simply guessing, the plugin locks the account after ten failed attempts. A six-digit code has a million possibilities, so ten guesses should be a rounding error against it. That lockout is the only thing that makes the code safe.
The flaw is in how the plugin counts those attempts. According to Wordfence's analysis, the verification routine reads the current count, adds one, and writes it back as separate steps, with no database-level guard that rejects an eleventh try and no lock to serialize the writes. That is a classic time-of-check-to-time-of-use (TOCTOU) race: if an attacker fires many verification requests at the same instant, each one reads the same low count before any of them writes it back, so they all slip past the ten-attempt cap. Once the cap is gone, a million-code keyspace is brute-forceable.
LatePoint does guard the endpoint with a nonce, a single-use token meant to prove a request is legitimate. It does not help here. Wordfence notes the same nonce is handed out by the plugin's public request-code and resend-code endpoints, so any unauthenticated visitor can collect one before starting the race.
Who is exposed, and what it gets an attacker
The precondition is modest: the attacker needs the email or phone a victim signed up with, and for a public booking business that contact detail is often easy to find. From there, winning the race yields full access to that customer's LatePoint account, their bookings, and the personal data attached to them. The CVSS rating marks confidentiality and integrity as high and availability as unaffected, which matches that outcome: read and alter a victim's records, not crash the site.
LatePoint is one of the more widely deployed booking plugins, with more than 100,000 active installations per its WordPress.org listing. It has carried a run of authentication and access-control bugs this year, so a site that patched an earlier LatePoint advisory is not automatically clear of this one. Check your installed version against the fix, not against your memory of the last update.
Update to 5.7.5, then check your logs
Patching is the fix; there is no setting that makes the vulnerable code safe. Update to LatePoint 5.7.5 or newer. As of publication there is no public proof-of-concept exploit and the flaw is not on CISA's Known Exploited Vulnerabilities list, which makes now, before an exploit circulates, the moment to act.
After updating, look back for abuse. The race leaves a fingerprint. LatePoint routes its OTP flow through wp-admin/admin-ajax.php, and winning the race requires a burst of near-simultaneous requests from one source. Legitimate code entry is a handful of requests over several seconds; a single address firing dozens into a one- or two-second window is not. Rank your web server's access log by which clients hit that endpoint hardest:
grep '"POST /wp-admin/admin-ajax.php' access.log \ | awk '{print $1}' \ | sort | uniq -c | sort -rn \ | head
An address at the top of that list with an implausible volume, especially clustered into a few seconds, is worth pulling apart. The POST body is not written to the access log, so you cannot see the OTP route directly; the concurrency itself is the tell.
This is the shape of signal a managed detection layer exists to catch. Suriq reads the web, system, and application logs your servers already produce and raises an alert when the pattern breaks, so a single client hammering one endpoint does not sit unnoticed until a customer reports a hijacked account.