Secure LatePoint Accounts Against OTP Race Condition Bypass Attack
Unauthenticated attackers can seize customer accounts in the LatePoint WordPress plugin by exploiting a timing flaw that circumvents login lockout protections.
Key points
- CVE-2026-110653 allows unauthenticated account takeover in LatePoint versions up to 5.7.4.
- The flaw is a race condition in the OTP verification process rated Critical by NVD.
- Attackers need only a target's email or phone number to initiate the brute-force attack.
An unauthenticated attacker who knows a customer’s registered email address or phone number can fully compromise their LatePoint account, according to the National Vulnerability Database. By exploiting a timing flaw in the appointment booking plugin, adversaries bypass the one-time password lockout mechanism and brute-force the six-digit code. This grants the attacker complete access to the victim’s personal data, booking history, and account settings within the WordPress environment.
The vulnerability, identified as CVE-2026-110653, carries a CVSS score of 9.1, which the NVD classifies as Critical. It affects all versions of the Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress up to and including version 5.7.4. The issue stems from a non-atomic read-modify-write operation on the verification attempts counter, creating a window where concurrent requests can defeat the ten-attempt limit.
How the attack works
The flaw exists in the `verifyOTP` function, which increments the attempt counter using a stale in-memory value rather than a locked database row. According to the NVD record, there is no conditional guard on the update operation and no row lock to prevent simultaneous access. This time-of-check to time-of-use window allows an attacker to fire multiple concurrent requests to the `auth__verify_otp` endpoint simultaneously. These parallel requests bypass the lockout cap before the system registers the previous failed attempts.
The plugin includes a nonce check on the endpoint, but this control does not mitigate the issue. The NVD notes that the nonce is publicly emitted by unauthenticated endpoints used to request or resend OTPs. Consequently, any attacker can obtain the necessary nonce trivially before launching the race condition attack. This renders the security token ineffective against coordinated, high-volume brute-force attempts targeting the authentication logic.
Who is affected
This vulnerability impacts websites running the LatePoint plugin for WordPress in versions 5.7.4 or earlier. Small-business owners relying on this tool for calendar scheduling and appointment management are at risk if they have not updated their software. The attack requires no prior authentication, meaning anyone with knowledge of a customer’s contact details can attempt to take over their account. As Shell Bulletin reported on 2026-10-10 regarding the PPOM WooCommerce plugin, unauthenticated flaws in popular WordPress extensions pose significant risks to site integrity and user privacy.
What to watch
No fix has been confirmed yet in the provided source material. Site administrators should monitor the vendor’s official communication channels for a patch announcement. Users should check their plugin version immediately to determine if they are running a vulnerable release. Security teams should watch for unusual login activity or OTP request spikes, which could indicate an active exploitation attempt against the authentication system.
What made it possible
Teams usually encounter this class of flaw when concurrent requests exploit a gap between checking a security condition and enforcing it. The weakness depends on the application failing to lock the relevant data row during updates, allowing stale values to persist in memory. This technique serves the initial access stage of an intrusion by defeating rate-limiting controls. Check whether your authentication logic uses atomic operations or database locks to prevent multiple simultaneous attempts from bypassing counters.
What to do and how to stay safe: LatePoint
- Verify your LatePoint plugin version and confirm it is below 5.7.4 to assess immediate exposure.
- Monitor server logs for spikes in OTP verification requests from single IP addresses or user agents.
- Implement additional server-side rate limiting on authentication endpoints to mitigate brute-force attempts.
- Wait for the vendor to release a patched version before updating, ensuring you do not apply unverified fixes.
Step-by-step guide: How Security Advisories Drive Patch Decisions and Reduce Risk
General security guidance from the Shell Bulletin newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for the LatePoint race condition vulnerability?
The National Vulnerability Database rates CVE-2026-110653 with a CVSS score of 9.1, which is classified as Critical.
Which versions of the LatePoint plugin are vulnerable to this attack?
All versions of the Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress up to and including version 5.7.4 are affected.
Does the nonce check protect against this specific race condition attack?
No, the nonce check does not mitigate the issue because the nonce is publicly available via unauthenticated endpoints and can be obtained trivially by attackers.
