LatePoint <= 5.7.2 - Unauthenticated Account Takeover of Subscriber-Level Users via Customer Email to Username Matching

ID

WPSEC-2026-0285

Plugin

Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress (latepoint)

Affected

all versions before 5.7.3

Remediation

Update to 5.7.3 or later.

CVSS 3.1

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Weakness

CWE-287

Usage

Plugin Medium · Affected versions Low among sites WPSec scans, 2026-10-22

Attack surface

LatePoint on WPSec AttackSurface

Fix released

2026-09-29

Published

2026-10-02

Description

The LatePoint plugin for WordPress is vulnerable to account takeover in all versions up to, and including, 5.7.2. This is due to the create_wp_user_for_customer() function falling back to matching a new customer's email address against WordPress usernames (username_exists()) when no account uses that email, after which authorize_customer() logs the requester in as the matched WordPress user. This makes it possible for unauthenticated attackers to register through the booking form with an email address equal to an existing user's login name and obtain a session as that user, provided the 'WordPress users as customers' setting is enabled (off by default), the target's username is an email-formatted string that differs from the account's email address, and the account is not already linked to a LatePoint customer. Only accounts with the subscriber, customer or LatePoint customer role can be taken over.

References

• https://wpsec.com/vuln/WPSEC-2026-0285/
• https://plugins.svn.wordpress.org/latepoint/tags/5.7.3/
• https://wordpress.org/plugins/latepoint/

Published by WPSec. Provided as is, without warranty. Corrections: contact us.

This advisory as JSON or Markdown · All advisories: JSON, RSS