AI analysis
Claude Opus · 9 Nov 2026, 10:20 CET
LatePoint booking plugin for WordPress lets unauthenticated attackers take over customer accounts
LatePoint for WordPress through 5.7.6 lets unauthenticated attackers reset a customer's password and take over the account, exposing bookings, orders and personal data. Update beyond 5.7.6 once a confirmed fix is available, or disable the plugin's public customer features until then.
In plain terms
LatePoint is an appointment booking and scheduling plugin for WordPress. All versions up to and including 5.7.6 contain a flaw in how the plugin looks up records in its database. An attacker with no account on the site can trick the plugin's password change feature into matching a real customer record without knowing that customer's secret reset token, then set a new password of their choosing.
The attacker can then sign in as that customer and see their bookings, orders and personal details. If the site links LatePoint customers to regular WordPress user accounts, the attacker also gains control of the linked WordPress login. Any business that takes bookings through LatePoint should treat this as urgent, especially because customer contact details can also be exposed along the way.