Latepoint · Appointment Booking Plugin – Latepoint | Calendar & Scheduling For Wordpress · CVE-2026-100163
The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 5.7.2 via the OsCustomerHelper::create wp user for customer() helper reached from the public process step customer() booking step. When the 'Use WordPress users as customers' option is enabled, the helper falls back from email exists() to username exists( $customer->email ), which matches any WordPress user whose user login equals the victim customer's email even when that user's user email is completely different, and links that WordPress user's ID into the victim's LatePoint customer row (only privileged roles are excluded; Subscriber is allowed). This makes it possible for authenticated attackers, with Subscriber-level access and above, to take over another customer's LatePoint account — accessing their bookings, service, agent, and calendar data, and having the victim customer's email overwritten with the attacker's on next login — by holding a Subscriber account whose user login equals the victim's email and submitting an unauthenticated public booking step registration request.