{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-100163", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-09-25T12:34:07.288Z", "datePublished": "2026-10-14T07:43:31.547Z", "dateUpdated": "2026-10-14T07:43:31.547Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-10-14T07:43:31.547Z"}, "affected": [{"vendor": "latepoint", "product": "Appointment Booking Plugin \u2013 LatePoint | Calendar & Scheduling for WordPress", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "5.7.2", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Appointment Booking Plugin \u2013 LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 5.7.2 via the OsCustomerHelper::create_wp_user_for_customer() helper reached from the public process_step_customer() booking step. When the 'Use WordPress users as customers' option is enabled, the helper falls back from email_exists() to username_exists( $customer->email ), which matches any WordPress user whose user_login equals the victim customer's email even when that user's user_email is completely different, and links that WordPress user's ID into the victim's LatePoint customer row (only privileged roles are excluded; Subscriber is allowed). This makes it possible for authenticated attackers, with Subscriber-level access and above, to take over another customer's LatePoint account \u2014 accessing their bookings, service, agent, and calendar data, and having the victim customer's email overwritten with the attacker's on next login \u2014 by holding a Subscriber account whose user_login equals the victim's email and submitting an unauthenticated public booking step registration request."}], "title": "Appointment Booking Plugin <= 5.7.2 - Unauthenticated Authentication Bypass to Customer Account Takeover via Insufficient Verification in create_wp_user_for_customer() username_exists Fallback", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2a942d71-7172-4e02-9faa-3a2c1c9e7fbd?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.2/lib/helpers/customer_helper.php#L259"}, {"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.2/lib/helpers/customer_helper.php#L274"}, {"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.2/lib/helpers/steps_helper.php#L2156"}, {"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.2/lib/helpers/steps_helper.php#L2146"}, {"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.2/latepoint.php#L1072"}, {"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.3/lib/helpers/customer_helper.php"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-287 Improper Authentication", "cweId": "CWE-287", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "baseScore": 7.4, "baseSeverity": "HIGH"}}], "credits": [{"lang": "en", "type": "finder", "value": "OKISO"}], "timeline": [{"time": "2026-09-25T12:49:14.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2026-10-13T19:19:40.000Z", "lang": "en", "value": "Disclosed"}]}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Appointment Booking Plugin \u2013 LatePoint | Calendar & Scheduling for WordPress", "vendor": "latepoint", "versions": [{"lessThanOrEqual": "5.7.2", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Appointment Booking Plugin \u2013 LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 5.7.2 via the OsCustomerHelper::create_wp_user_for_customer() helper reached from the public process_step_customer() booking step. When the 'Use WordPress users as customers' option is enabled, the helper falls back from email_exists() to username_exists( $customer->email ), which matches any WordPress user whose user_login equals the victim customer's email even when that user's user_email is completely different, and links that WordPress user's ID into the victim's LatePoint customer row (only privileged roles are excluded; Subscriber is allowed). This makes it possible for authenticated attackers, with Subscriber-level access and above, to take over another customer's LatePoint account \u2014 accessing their bookings, service, agent, and calendar data, and having the victim customer's email overwritten with the attacker's on next login \u2014 by holding a Subscriber account whose user_login equals the victim's email and submitting an unauthenticated public booking step registration request."}], "id": "CVE-2026-100163", "lastModified": "2026-10-14T08:17:02.257", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 5.2, "source": "security@wordfence.com", "type": "Primary"}]}, "published": "2026-10-14T08:17:02.257", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.2/latepoint.php#L1072"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.2/lib/helpers/customer_helper.php#L259"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.2/lib/helpers/customer_helper.php#L274"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.2/lib/helpers/steps_helper.php#L2146"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.2/lib/helpers/steps_helper.php#L2156"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.3/lib/helpers/customer_helper.php"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2a942d71-7172-4e02-9faa-3a2c1c9e7fbd?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-287"}], "source": "security@wordfence.com", "type": "Primary"}]}

{}

{}