CVE-2026-118066: Authentication bypass in LatePoint WordPress plugin

CVE-2026-118066 is an authentication bypass vulnerability in the LatePoint (Appointment Booking Plugin) for WordPress. The flaw exists in the OsModel::build_conditions_query() function in lib/models/model.php, which compares WHERE-clause values against the literal strings 'IS NULL' and 'IS NOT NULL' without SQL parameterization. Unauthenticated attackers can exploit this weakness to bypass authentication and assume control of customer accounts, gaining access to sensitive data, bookings, orders, and when configured, linked WordPress subscriber or customer-role accounts.

The vulnerability carries a CVSS score of 9.1, classified as critical. Technical indicators point to a severe flaw: neither WordPress's sanitize_text_field() function nor the version 5.7.5 is_scalar() hardening guard properly filter the malicious input. The vulnerability was disclosed on November 7, 2026, with detailed technical documentation from NVD. Public exploits on GitHub repositories are not currently confirmed, but the risk of active exploitation is high given the critical nature and simplicity of the attack vector.

To defend against CVE-2026-118066, IT teams and system administrators must: immediately upgrade LatePoint plugin to version 5.7.7 or later; audit access and password reset logs for anomalies in recent weeks; if wp_users_as_customers is enabled, monitor WordPress subscriber and customer accounts for unauthorized access; disable public AJAX routes customer_cabinet__change_password and steps__start_from_order_intent until patched, if operationally feasible.