An appointment-booking plugin used on more than 100,000 WordPress sites contains a flaw that can let a visitor with no account take over a customer account. The vulnerability, tracked as CVE-2026-118066, was published by Wordfence on 7 November 2026 and carries a score of 9.1 out of 10, rated Critical.

The plugin is Appointment Booking Plugin - LatePoint, a calendar and scheduling tool. All versions up to and including 5.7.6 are affected. Wordfence classified the weakness as improper authentication, under CWE-287, and gave it the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, which reflects a network attack that needs no privileges and no user interaction.

The cause lies in how the plugin builds database queries. In lib/models/model.php, the function OsModel::build_conditions_query() treats the literal strings 'IS NULL' and 'IS NOT NULL' as instructions when they appear as values, and places the matching text directly into the SQL WHERE clause instead of binding it as a parameter. Two defences that might have been expected to stop it do not: the record states that sanitize_text_field() and an is_scalar() guard added in version 5.7.5 both let the plain text string pass through unchanged, because it is an ordinary, well-formed string.

An attacker can use that behaviour on a public route. By sending params[password_reset_token] set to 'IS NOT NULL' to the customer_cabinet__change_password AJAX route, the attacker creates a condition that matches every row with a non-null account_nonse value. The query resolves to the lowest-id customer, and the request overwrites that customer's password with a value chosen by the attacker. That gives full access to the customer's bookings, orders and personal information.

Wordfence describes two supporting steps. The attacker can first learn a target customer's email by sending the same sentinel value in params[order_intent_key] to the public steps__start_from_order_intent route, which returns the name and email from the first matching order intent. The attacker can then trigger a password reset for that customer to arm the 15-minute freshness window the change-password route requires. Where the plugin's wp_users_as_customers option is enabled, the record says the linked WordPress subscriber or customer-role account can also be taken over.

The fix picture is unusually unclear. LatePoint's changelog records two security releases just before the CVE appeared: version 5.7.7, dated 2 November, which says the plugin's security was hardened and credits WordFence, and version 5.7.8, dated 3 November, which says a security bug was addressed and also credits WordFence. Neither entry names a CVE, a severity or a component, and the CVE record itself names no fixed version. No published source states which release closes this flaw, so the safest reading is to install the newest release, 5.7.8, which sits above the affected ceiling of 5.7.6 and also carries the second security fix. A second LatePoint flaw, CVE-2026-119152, a stored cross-site scripting issue scored 5.4, was published on the same day with the same affected ceiling.

No exploitation of this flaw has been reported by Wordfence, the vendor or any source checked. CISA's assessment, recorded on 8 November, listed exploitation as none, while rating the flaw as automatable with a total technical impact. The record is not in CISA's Known Exploited Vulnerabilities catalogue. Site owners should not rely on a scanner alone to spot it: NVD lists the record as Deferred, with no CPE data attached, so tools that match on CPE may stay quiet. Checking the plugin's reported version directly is the check that works.

Site owners should update LatePoint to 5.7.8, then look at the lowest-id and oldest customer records for a password change they cannot explain. They should also check whether wp_users_as_customers is enabled, because that setting extends the impact from the plugin's own customer records to linked WordPress accounts. Web and admin-ajax.php logs can be searched for requests to the change-password route carrying 'IS NOT NULL' or 'IS NULL' in the password-reset token, and for order-intent requests carrying the same text, since the sentinel has to appear in the request to work.