CYBUNKR

LatePoint booking plugin:public exploit lets anyone take over customer accounts

Published

CVE-2026-118066 in LatePoint 5.7.6 and earlier lets someone with no login take over customer accounts on WordPress booking sites. Exploit code is public. Update to 5.7.8, the latest version.

If your website takes bookings with the LatePoint appointment plugin, update it to 5.7.8, the latest version, today. CVE-2026-118066 lets an attacker with no account reset a customer's password to one they choose, giving them that customer's bookings, orders and personal details (CVE record).

LatePoint is on more than 100,000 WordPress sites (WordPress.org), and a ready-made test for the flaw was published on 8 November (ProjectDiscovery).

Who is affected

  • LatePoint 5.7.6 and earlier (CVE record). 5.7.7, released on 2 November, and 5.7.8, released on 3 November, both carry security fixes credited to Wordfence (LatePoint changelog).
  • How it works: the plugin treats the text IS NOT NULL as part of a database query instead of a value. Sent as a password-reset token to a public page, it matches the first customer with a reset pending. A second public request leaks a customer's name and email, and the attacker can trigger the reset themselves (CVE record).
  • Customer logins linked to WordPress accounts? If LatePoint is set to use WordPress users as customers, the attacker also takes over the linked WordPress subscriber or customer account (CVE record). The record does not say administrator accounts are at risk.
  • It is rated 9.1 out of 10 (CVE record).

What has been seen so far

A snapshot from 10 November:

  • Jakub Herman found the flaw. Wordfence notified the vendor on 27 October and disclosed it on 6 November, and the CVE was published on 7 November (CVE record).
  • On 8 November ProjectDiscovery published a Nuclei template, a scanner check that sends the IS NOT NULL trick to a live site and reports whether it worked (ProjectDiscovery). CIRCL's Vulnerability-Lookup logged it as a confirmed exploit the same day.
  • We have found no report of attacks yet. CISA's assessment in the CVE record says no exploitation and that the attack is automatable (CVE record), and it is not in CISA's Known Exploited Vulnerabilities catalog.

What to do

  • Update LatePoint to 5.7.8 from Plugins in the WordPress admin, and turn on automatic updates for it. If you use LatePoint add-ons, update those too.
  • Check for misuse: look for customers who say they can't log in, or who got password-reset emails they didn't ask for. If you find any, contact them, reset their passwords, and consider whether personal data has been exposed.
  • Site run by a web developer or agency? Ask them which LatePoint version you are on today.

How we can help

Think customer accounts on your site have been accessed? Get in touch.

Sources