LatePoint: authentication bypass via account takeover (CVE-2026-118066)
A vulnerability, CVE-2026-118066 (CVSS 9.1), was reported in the LatePoint plugin for WordPress. The OsModel::build_conditions_query() function inserts the values 'IS NULL' and 'IS NOT NULL' into SQL without binding them as parameters. An unauthenticated attacker can change a customer's password and access their data.
Checked in Shield: no
Who is affected
WordPress sites running LatePoint (Appointment Booking Plugin, Calendar & Scheduling) in all versions up to and including 5.7.6. If the wp_users_as_customers option is enabled, the linked WordPress account can also be taken over.
How to check
In the WordPress admin, open Plugins and find LatePoint. If the installed version is 5.7.6 or lower, the site is affected.
How to fix
The source does not name a fixed version. Watch for a plugin update and install it as soon as it is released. Until then, you may temporarily deactivate the plugin.
What Shield checks not checked
Checked in Shield: no. This is usually not visible from outside, or the check has not been added yet; we collect such cases and add checks in batches.
Good to know
Exploitation status and the fixed version number are not disclosed yet. Source: NVD, CVE-2026-118066.
