CVE-2026-110653: Authentication Bypass via Race Condition in LatePoint Booking Plugin

Overview

A critical authentication-bypass vulnerability, tracked as CVE-2026-110653, has been disclosed in the Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress, affecting all versions through 5.7.4. The flaw carries a CVSS 3.1 score of 9.1 and is classified under CWE-287 (Improper Authentication), rooted in a classic Time-of-Check-to-Time-of-Use (TOCTOU) race condition.

LatePoint protects its one-time-password (OTP) login flow with a 10-attempt lockout, but the counter that enforces that limit is read, incremented, and written back in three separate steps with no database-level locking. An attacker who fires concurrent requests at the verification endpoint can slip multiple guesses through the same stale "attempts so far" window, defeating the lockout and brute-forcing a customer's 6-digit OTP.

Technical Details

How It Works

LatePoint's verifyOTP() function is meant to lock an account out of further OTP attempts once it hits 10 failed guesses. The problem is in how that counter is enforced: the current attempt count is read into memory, compared against the limit in application code, and only then written back with a plain UPDATE — there is no SELECT ... FOR UPDATE row lock and no conditional WHERE attempts < 10 guard on the update itself.

That gap between "check" and "use" is the race condition. If an attacker sends many auth__verify_otp requests at once, several of them can read the same stale attempt count before any of the writes land, so none of them individually trip the lockout — even though the account has technically been guessed against far more than 10 times. Because a 6-digit OTP has only one million possible values, a race-widened attempt budget makes brute-forcing it practical within a normal attack window.

Developers did add a nonce check (otp_verify_otp_nonce) to the endpoint, but it provides no real protection here: the nonce is handed out by the unauthenticated request_otp and resend_otp endpoints, so any attacker who knows a target's email address or phone number can fetch a valid nonce before ever touching the race.

Impact Assessment

Who Is At Risk

• Any WordPress site running LatePoint through version 5.7.4 for appointment booking or scheduling
• Businesses whose customer base uses OTP login (rather than password login) to manage bookings
• Sites where customer email addresses or phone numbers are easily discoverable (e.g. prior bookings, support tickets, or public contact forms)

Attack Chain

1. Target selection — Attacker identifies a target customer's email or phone number tied to a LatePoint account.
2. Nonce harvesting — Attacker calls the unauthenticated request_otp or resend_otp endpoint to obtain a valid otp_verify_otp_nonce.
3. Concurrent guessing — Attacker fires a burst of parallel requests to auth__verify_otp, each trying a different 6-digit code, exploiting the TOCTOU window so the lockout counter never catches up.
4. Account takeover — Once the correct OTP lands inside the race, the attacker is authenticated as the target customer.

Mitigation

Immediate Actions

• Update LatePoint to version 5.7.5 or later, which closes the race by enforcing the attempt limit atomically at the database layer.
• If immediate patching isn't possible, consider rate-limiting requests to auth__verify_otp at the web server or WAF layer (e.g. capping concurrent requests per IP/session) as a stopgap.

Detection Opportunities

• Monitor for bursts of near-simultaneous requests to auth__verify_otp from a single IP or small IP range, especially against the same target identifier.
• Watch for repeated request_otp/resend_otp calls immediately followed by a spike in verification attempts.

Defence-in-Depth

• Where supported, prefer password-based or WebAuthn login over OTP-only flows for accounts holding sensitive booking data.
• Apply connection/request concurrency limits per client at the reverse proxy to blunt race-condition exploitation generally, not just for this flaw.

Background

LatePoint is a calendar and appointment-scheduling plugin for WordPress used by salons, clinics, consultants, and other service businesses to manage bookings directly from their site. Its OTP-based customer login is a convenience feature meant to avoid forcing customers to set and remember passwords — the same design choice that makes this lockout-bypass bug particularly impactful, since OTP is often the only authentication factor protecting the account.

References

• NVD — CVE-2026-110653
• Strix — CVE-2026-110653: Appointment Booking Plugin
• VulDB — CVE-2026-110653