LatePoint Appointment Booking Plugin OTP Verification Race Condition Authentication Bypass

CVE-2026-110653 is a Time-of-Check-to-Time-of-Use (TOCTOU) race condition in the verifyOTP function of the LatePoint Appointment Booking Plugin for WordPress, affecting all versions through 5.7.4. The OTP verification endpoint (auth__verify_otp) is supposed to lock an account after ten failed attempts, but the attempt counter uses a classic non-atomic read-modify-write: each concurrent request reads the *same stale count* from memory before any single UPDATE commits, so all of them pass the < 10 check. An unauthenticated attacker who knows a customer's registered email or phone number can fire hundreds of parallel requests, brute-forcing the 6-digit OTP code (1,000,000 combinations) well past the intended cap, and log in as that customer. The fix in 5.7.5 replaces the in-memory increment with an atomic UPDATE … SET attempts = attempts + 1 WHERE attempts < 10 guard with row-level locking.

The vendor's CRITICAL 9.1 rating accurately describes the CVSS math — unauthenticated, network-reachable, no user interaction, high C+I impact — but it overstates the real-world blast radius. The vulnerability compromises *LatePoint customer accounts* (booking data, names, emails, phone numbers, appointment notes), not WordPress administrator accounts or the underlying server. OTP-based authentication is an *optional* configuration that must be explicitly enabled; the default setup uses password-based login, which is unaffected. And the attacker still needs a valid customer email or phone to target. For the ~100K–170K WordPress sites running LatePoint, only the subset with OTP auth enabled and publicly reachable booking portals are in scope. This is a genuine auth-bypass with PII exposure consequences — especially for healthcare or legal appointment sites — but it is not an infrastructure-class vulnerability.

Sources.

1. NVD — CVE-2026-110653
2. VulDB — LatePoint verifyOTP TOCTOU
3. Offseq Radar — CVE-2026-110653 Analysis
4. Strix.ai — CVE-2026-110653
5. TheHackerWire — CVE-2026-110653 Analysis & Fix
6. LatePoint Official Changelog
7. WPScan — LatePoint Plugin Vulnerabilities
8. LatePoint OTP Configuration Docs

Run this script on the WordPress host (or any machine with filesystem access to the WordPress installation directory). Invoke as: sudo bash check_cve_2026_110653.sh /var/www/html where the argument is the WordPress root directory. Requires read access to the plugin directory. No network access or WordPress database credentials needed.

#!/bin/bash
# CVE-2026-110653 Checker — LatePoint OTP Race Condition Auth Bypass
# Usage: bash check_cve_2026_110653.sh /path/to/wordpress
# Exit codes: 0 = PATCHED, 1 = VULNERABLE, 2 = UNKNOWN

set -euo pipefail

WP_ROOT="${1:-/var/www/html}"
PLUGIN_DIR="$WP_ROOT/wp-content/plugins/latepoint"
README="$PLUGIN_DIR/readme.txt"
MAIN_FILE="$PLUGIN_DIR/latepoint.php"

if [ ! -d "$PLUGIN_DIR" ]; then
  echo "UNKNOWN — LatePoint plugin not found at $PLUGIN_DIR"
  exit 2
fi

# Extract version from main plugin file header or readme.txt
VERSION=""
if [ -f "$MAIN_FILE" ]; then
  VERSION=$(grep -i 'Version:' "$MAIN_FILE" | head -1 | sed 's/.*Version:[[:space:]]*//' | tr -d '[:space:]')
fi
if [ -z "$VERSION" ] && [ -f "$README" ]; then
  VERSION=$(grep -i 'Stable tag:' "$README" | head -1 | sed 's/.*Stable tag:[[:space:]]*//' | tr -d '[:space:]')
fi

if [ -z "$VERSION" ]; then
  echo "UNKNOWN — could not determine LatePoint version"
  exit 2
fi

echo "Detected LatePoint version: $VERSION"

# Compare versions: vulnerable if <= 5.7.4
version_lte() {
  [ "$(printf '%s\n' "$1" "$2" | sort -V | head -n1)" = "$1" ]
}

FIXED="5.7.5"

if version_lte "$VERSION" "5.7.4"; then
  # Double-check: look for the atomic SQL pattern in otp_helper.php
  OTP_FILE="$PLUGIN_DIR/lib/helpers/otp_helper.php"
  if [ -f "$OTP_FILE" ]; then
    if grep -q 'attempts < 10' "$OTP_FILE" 2>/dev/null || grep -q 'attempts + 1' "$OTP_FILE" 2>/dev/null; then
      echo "PATCHED — version $VERSION but atomic OTP guard detected (possible backport)"
      exit 0
    fi
  fi
  echo "VULNERABLE — LatePoint $VERSION is affected by CVE-2026-110653 (fixed in $FIXED)"
  exit 1
else
  echo "PATCHED — LatePoint $VERSION >= $FIXED"
  exit 0
fi