CVE-2026-110653

Summary

The LatePoint WordPress plugin has an authentication bypass flaw due to a race condition in its OTP verification system. Attackers can brute-force OTP codes by sending concurrent requests, allowing them to impersonate any registered user and access their bookings and personal data.

Exploitability

Exploitation is straightforward with minimal preconditions - attackers only need a target's email or phone number and can launch concurrent requests to the auth__verify_otp endpoint without requiring any special privileges or complex payloads.

Blast radius

The impact could be significant as attackers gain full access to targeted user accounts including all bookings, personal information, and scheduling data, potentially affecting multiple customers if the plugin is widely used.

Detection

Monitor for unusual concurrent requests to the /wp-admin/admin-ajax.php?action=auth__verify_otp endpoint with rapid successive attempts, particularly when multiple requests arrive within seconds of each other for the same user account.

Prioritized remediation

Upgrade to version 5.7.5 or later which contains the fix for the race condition in OTP verification.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.