LatePoint, a WordPress plugin for appointments and bookings, carried an unauthenticated account takeover in its public customer cabinet. An attacker could overwrite a customer's password without a token, a login or an email link.
What happened
The flaw is tracked as CVE-2026-118066 and scored 9.1 by the assigning CNA. It sits in the plugin's model layer, where a query builder compared incoming values against the literal strings 'IS NULL' and 'IS NOT NULL' and, when a value matched, wrote it into the SQL statement without binding it as a parameter. The earlier scalar-type guard does not stop it, because the sentinel string passes through unchanged.
That turned the password reset handler on the customer cabinet into an open door. A crafted value in the reset parameter matched every account row, the query resolved to the lowest-numbered customer, and the request rewrote that customer's password. The disclosure was published on 7 November.
Every version up to and including 5.7.6 is affected. 5.7.7 contains the fix and 5.7.8 is the current release, which adds a second security correction.
Who is affected
- WordPress sites running LatePoint 5.7.6 or earlier
- Booking, appointment and scheduling sites, where the customer cabinet must stay publicly reachable
- Sites with plugin auto-updates switched off, or a staging copy that never gets patched
What to do now
Update LatePoint to 5.7.7 or later, then look for customer accounts whose password changed without a reset request.
- Check the installed version under Plugins, not the version offered in the update notice
- Review customer and user accounts for changes since late October, including email address edits
- Force a password reset on any account altered without a request from the customer
- Remove the plugin from sites that no longer use it instead of leaving it deactivated on disk
What this means for South African businesses
Booking plugins sit on exactly the sites SMEs run themselves: guesthouses, salons, clinics and consultancies that take appointments online. The likely attacker here is automated scanning that finds the endpoint and takes the account, and the first visible symptom is a locked-out customer or a booking confirmation sent somewhere unexpected. That is a reputation problem before it is a data breach, which is why it belongs in this week's maintenance window and not next month's.
Source: Wordfence Intelligence advisory for CVE-2026-118066.
Also on the blog
Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.