CVE-2026-118066

Summary

The LatePoint WordPress plugin (≤5.7.6) contains an SQL injection flaw in its `OsModel::build_conditions_query()` function that allows unauthenticated attackers to bypass authentication by injecting 'IS NOT NULL' into WHERE clauses, enabling account takeover via password reset token manipulation. This occurs because sentinel values are concatenated directly into SQL without parameter binding, and existing sanitization fails to neutralize them.

Exploitability

Exploitation is trivial for unauthenticated attackers as it requires only sending two specific AJAX requests to publicly accessible endpoints with crafted parameters; no authentication or special privileges are needed.

Blast radius

Successful exploitation grants full access to a victim's bookings, orders, and PII, and may extend to WordPress account takeover if linked to a subscriber/customer role via the `wp_users_as_customers` option, potentially compromising multiple systems or data sets.

Detection

Defenders should monitor WordPress debug logs and database query logs for SQL queries containing unbound literal strings 'IS NULL' or 'IS NOT NULL' in WHERE clauses on tables storing account_nonse or order_intent_key values; additionally, repeated failed password reset attempts followed by successful resets for low-ID users may indicate exploitation.

Prioritized remediation

Upgrade to version 5.7.7 or later, which patches the SQL injection by properly parameterizing the 'IS NULL' and 'IS NOT NULL' comparisons in `OsModel::build_conditions_query()`.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.