CVE-2026-118066

Name of the Vulnerable Software and Affected Versions LatePoint | Calendar & Scheduling for WordPress versions prior to 5.7.7

Description An authentication bypass allows unauthenticated attackers to take over customer accounts. The issue exists in the OsModel::build conditions query() function within lib/models/model.php, which compares WHERE-clause values against literal strings 'IS NULL' and 'IS NOT NULL' and concatenates matches directly into SQL without parameter binding. This flaw persists despite the use of sanitize text field() and the is scalar() hardening guard. Attackers can send params[password reset token]=IS NOT NULL to the customer cabinet change password AJAX endpoint to match non-null account nonse values, allowing them to overwrite a customer's password. If the wp users as customers option is enabled, this can lead to the takeover of linked WordPress subscriber or customer-role accounts. Additionally, attackers can identify target emails by sending params[order intent key]=IS NOT NULL to the steps start from order intent endpoint.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.