9.1 Critical: Concurrent Requests Break LatePoint Login Locks for Account Theft

A flaw in the LatePoint WordPress plugin allows attackers to take over customer accounts by tricking the system into ignoring login attempt limits. This issue affects all plugin versions up to 5.7.4 and enables unauthenticated users to access private booking data if they know a target's email or phone number.

How it unfolded

• The vulnerability exists in the `verifyOTP` function, which handles one-time password checks.
• The code updates the attempt counter using a stale value stored in memory.
• This creates a timing gap where concurrent requests bypass the ten-attempt lockout.

Who is affected

Any WordPress site running the Appointment Booking Plugin – LatePoint in version 5.7.4 or earlier is vulnerable. According to the National Vulnerability Database, the flaw allows unauthenticated attackers who know a registered email address or phone number to target specific customers. The attacker does not need existing credentials to begin the attack.

The vulnerability is rated 9.1 critical on the CVSS scale. It falls under CWE-287, which covers improper authentication mechanisms. The flaw allows an attacker to brute-force the six-digit OTP code by defeating the account lockout feature that normally stops repeated failed attempts after ten tries.

What happens next

No fix has been confirmed yet for this issue. System administrators should verify their plugin versions immediately. If a site runs version 5.7.4 or lower, it is exposed to this attack method until a vendor update is released.

The attack relies on a race condition in the database update process. The plugin fails to lock the row while checking the attempt count. This allows multiple requests to read the same low attempt number before any of them write the new, higher number back to the database.

As Circuit Observer reported on 2026-10-14 regarding FortiSandbox, authentication bypasses often stem from hard-coded keys or logic flaws. This LatePoint issue is different, relying on timing rather than a static secret, but it similarly grants unauthenticated access to protected endpoints.

The background in plain language

Teams usually protect accounts by locking them after several failed login attempts. This prevents attackers from guessing passwords or codes indefinitely. A race condition occurs when two processes try to change the same data at the same time. If the system does not coordinate these changes, it might miss a failed attempt. This allows an attacker to bypass the lock by sending many requests simultaneously, tricking the system into thinking fewer attempts were made.

Background: One-time passwords

One-time passwords work by generating a unique code from a shared secret and the current time. The server calculates the expected code and compares it to what you enter. This ensures that intercepted codes cannot be reused, adding a layer of protection beyond static credentials.

Read the full guide: How Do One Time Passwords Work: The Mechanics Behind Secure Access

What to do and how to stay safe: LatePoint

• Check your WordPress plugins for the LatePoint Appointment Booking Plugin and verify the version number.
• If you run version 5.7.4 or lower, monitor server logs for unusual spikes in authentication requests.
• Consider restricting access to the `auth__verify_otp` endpoint using web application firewalls.
• Wait for the vendor to release a confirmed update before applying any unofficial patches.

General security guidance from the Circuit Observer newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVE ID for this LatePoint vulnerability?

The vulnerability is tracked as CVE-2026-110653.

Does the nonce check protect against this attack?

No, the nonce is publicly available from unauthenticated endpoints and does not mitigate the race condition.

Which versions of LatePoint are affected?

All versions up to and including 5.7.4 are vulnerable.