LatePoint Through 5.7.6 - Actively Exploited Unauthenticated Account Takeover (CVE-2026-118066)

LatePoint versions 5.7.6 and earlier are vulnerable to an unauthenticated authentication bypass tracked as CVE-2026-118066. Patchstack lists the issue as actively exploited. The flaw can let an attacker reset a LatePoint customer password and take over the account without knowing the existing password. Sites should update to LatePoint 5.7.7 or later immediately; the current WordPress.org release is 5.7.8.

Table of Contents

Vulnerability summary

Product: Appointment Booking Plugin – LatePoint
Affected versions: 5.7.6 and earlier
Fixed version: 5.7.7; update to the latest available release
CVE: CVE-2026-118066
Attack class: Unauthenticated authentication bypass and customer account takeover
Severity: Critical 9.8 according to Patchstack; Critical 9.1 according to Wordfence
Exposure: WordPress.org lists more than 100,000 active installations
Exploitation status: Patchstack marks the vulnerability as known exploited. This is Patchstack exploitation telemetry, not a CISA KEV designation.

Prerequisites and exploit path

Wordfence reports that LatePoint’s model query builder treats special null-condition strings as SQL fragments instead of binding them as values. An unauthenticated request to the public customer password-change flow can therefore make a reset-token lookup match a non-null customer record and overwrite that customer’s password.

The attack targets a LatePoint customer account. If the LatePoint wp_users_as_customers option is enabled, the linked WordPress subscriber or customer account can also be taken over. Wordfence also describes a related public order-intent flow that can expose the first matching customer’s identity and a reset process that can establish the required short password-reset window. No prior account or user interaction is required.

Immediate remediation

Update LatePoint to version 5.7.7 or later. WordPress.org currently offers 5.7.8.
Purge page, object, and CDN caches after the update.
Invalidate active LatePoint customer sessions and force password resets for affected customer accounts where practical.
Review recent password-reset activity, customer-account changes, bookings, orders, and linked WordPress users.
If an update cannot be applied immediately, deactivate LatePoint or restrict access to its public customer cabinet and password-reset endpoints with a temporary WAF rule.

Verification and investigation

wp plugin get latepoint --fields=name,status,version,update,update_version
wp plugin update latepoint
wp option get wp_users_as_customers
wp user list --fields=ID,user_login,user_email,user_registered --orderby=registered --order=DESC
wp core verify-checksums
wp db check

The version check should report 5.7.7 or later. If the plugin is installed under a different commercial-package directory, use wp plugin list to identify its exact slug before updating.

Indicators of compromise

Unexpected requests to LatePoint customer password-change or order-intent routes.
Bursts of password-reset requests followed quickly by password changes or customer logins.
Changes to an older or low-ID LatePoint customer account without a corresponding support request.
Unknown modifications to bookings, orders, customer PII, or linked WordPress user accounts.
New sessions, password changes, or profile edits from unfamiliar IP addresses.

Preserve web, WAF, mail, and authentication logs before cleanup. Rotate affected passwords and API credentials, revoke unknown sessions and application passwords, inspect administrator accounts and scheduled tasks, and restore only from a verified clean backup if compromise is confirmed.

Patch verification

The official WordPress.org changelog states that LatePoint 5.7.7 hardened plugin security and credits Wordfence. Version 5.7.8 contains an additional security fix. Administrators should therefore install the newest supported release rather than stopping at an older branch.

LatePoint Through 5.7.6 – Actively Exploited Unauthenticated Account Takeover (CVE-2026-118066)