LatePoint WordPress Plugin Authentication Bypass via Race Condition Flaw

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin is vulnerable to an authentication bypass via race condition in all versions up to and including 5.7.4.

The vulnerability is caused by a non-atomic read-modify-write on the OTP verification attempts counter in the verifyOTP function. The counter is incremented using a stale in-memory value, with no conditional WHERE attempts < 10 guard on the UPDATE and no SELECT ... FOR UPDATE row lock, creating a TOCTOU window that lets concurrent requests bypass the 10-attempt lockout.

This allows unauthenticated attackers who know a target customer's registered email address or phone number to fire concurrent requests to the auth__verify_otp endpoint, defeat the lockout cap, brute-force the 6-digit OTP code, and authenticate as the targeted LatePoint customer. The nonce check on the endpoint does not mitigate the issue because the nonce is publicly emitted by the unauthenticated request_otp and resend_otp endpoints.

• Affects all versions up to and including 5.7.4.
• Attackers must know the target customer's registered email address or phone number.
• Concurrent requests can bypass the 10-attempt lockout and brute-force the 6-digit OTP.
• Successful exploitation grants full access to the target customer's account, bookings, and personal data.