Act nowDisclosed

Advisory · CVE-2026-118066

LatePoint password reset flaw lets anyone take over customer accounts

LatePoint for WordPress up to and including 5.7.6 lets an unauthenticated attacker reset any customer password by passing the literal value IS NOT NULL as the password reset token, rated critical at CVSS 9.1; fixed in 5.7.7.

Advisory published November 7, 2026Independent summary
Vendor
LatePoint
Product
LatePoint
Identifier / CWE
CVE-2026-118066
CWE-287
Action timing
Immediate
ELI5

Explain it like I’m five

LatePoint asks for a secret password-reset code before letting someone change a password, but it compares the code with a database trick instead of checking the actual value. An attacker can answer with the words IS NOT NULL, which the database reads as match anything, and the door opens.

SIMPLIFIED_ATTACK_PATH05 STEPS
  1. 01Target customer identified

    The attacker finds a target customer email by probing the public order-intent route, which returns the name and email from a matching order.

  2. 02Reset window armed

    The attacker triggers a password reset for that customer, creating a fresh 15-minute reset window.

  3. 03Sentinel token submitted

    The attacker submits IS NOT NULL as the password reset token to the public customer cabinet password-change route.

  4. 04Check passes for any customer

    The token comparison matches every non-null reset token, so the check passes and the password is overwritten with an attacker-chosen value.

  5. 05Account taken over

    The attacker logs in as the customer, reaching their bookings, orders, and personal data, and a linked WordPress account where that option is enabled.

What happened

Wordfence disclosed CVE-2026-118066 on November 6, 2026, and NVD published it on November 7: the Appointment Booking Plugin - LatePoint for WordPress is vulnerable to authentication bypass via account takeover in all versions up to and including 5.7.6. The plugin’s model query builder compares WHERE-clause values against the literal strings IS NULL and IS NOT NULL and concatenates a match directly into SQL without binding it as a parameter, so an unauthenticated attacker can send IS NOT NULL as the password reset token to the public customer cabinet password-change route and match every non-null account nonce, resolving to the lowest-id customer and overwriting that customer’s password. The record rates it critical at CVSS 9.1 under version 3.1, with network attack vector, low complexity, no privileges required, and no user interaction.

The attacker can first identify the target customer’s email through the public order-intent route, and can self-arm the 15-minute password-reset freshness window by triggering a reset for that customer directly. LatePoint is used on more than 100,000 WordPress sites, per the WordPress.org plugin page. The flaw is fixed in LatePoint 5.7.7.

What to do

  1. Inventory WordPress sites running LatePoint and record each installed version.
  2. Upgrade to LatePoint 5.7.7 or later.
  3. Review customer accounts for password changes and logins that cannot be accounted for, and where the wp_users_as_customers option is enabled, review the linked WordPress accounts as well.
  4. Force password resets for affected customers and rotate credentials for any linked WordPress account that changed hands.
  5. Review logs for requests carrying IS NOT NULL in password reset parameters.
  6. Verify the deployed plugin version after updating.

Management note

An unauthenticated account takeover in a booking plugin is a customer-data breach waiting for a script. The fix is a one-click update, so the gap is deployment speed, not patch availability.