{"id":"CVE-2026-118066","published":"2026-11-07T12:17:43.717","lastModified":"2026-11-08T19:17:34.637","description":"The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Authentication Bypass via Account Takeover in all versions up to, and including, 5.7.6. This is due to the `OsModel::build_conditions_query()` function in `lib/models/model.php` comparing WHERE-clause values against the literal strings `'IS NULL'` and `'IS NOT NULL'` and concatenating a match directly into SQL without binding it as a parameter, a flaw that neither `sanitize_text_field()` nor the 5.7.5 `is_scalar()` hardening guard closes, since both pass the scalar sentinel through unchanged. This makes it possible for unauthenticated attackers to send `params[password_reset_token]=IS NOT NULL` to the public `customer_cabinet__change_password` AJAX route to match every non-null `account_nonse` value, resolving to the lowest-id customer and overwriting that customer's password to an attacker-chosen value — granting full access to their bookings, orders, and PII, and, when the `wp_users_as_customers` option is enabled, takeover of the linked WordPress subscriber or customer-role account. The attacker can first identify the target customer's email by sending `params[order_intent_key]=IS NOT NULL` to the public `steps__start_from_order_intent` route, which returns the name and email from the first matching order intent, and can then self-arm the required 15-minute password-reset freshness window by triggering a reset for that customer directly.","cvssScore":9.1,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","cwes":["CWE-287"],"vendors":[],"products":[],"references":[{"url":"https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.5/latepoint.php#L1073","tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.5/lib/controllers/customer_cabinet_controller.php#L494","tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.5/lib/controllers/steps_controller.php#L178","tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.5/lib/helpers/customer_helper.php#L235","tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.5/lib/helpers/order_intent_helper.php#L184","tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.5/lib/helpers/params_helper.php#L14","tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.5/lib/models/model.php#L414","tags":[]},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=&old=3779410%40latepoint&new=3779410%40latepoint","tags":[]},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2f7f5dc8-8cf7-493d-b012-89ff36a4dc02?source=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The LatePoint WordPress plugin (≤5.7.6) contains an SQL injection flaw in its `OsModel::build_conditions_query()` function that allows unauthenticated attackers to bypass authentication by injecting 'IS NOT NULL' into WHERE clauses, enabling account takeover via password reset token manipulation. This occurs because sentinel values are concatenated directly into SQL without parameter binding, and existing sanitization fails to neutralize them.","exploitability":"Exploitation is trivial for unauthenticated attackers as it requires only sending two specific AJAX requests to publicly accessible endpoints with crafted parameters; no authentication or special privileges are needed.","blast_radius":"Successful exploitation grants full access to a victim's bookings, orders, and PII, and may extend to WordPress account takeover if linked to a subscriber/customer role via the `wp_users_as_customers` option, potentially compromising multiple systems or data sets.","remediation":"Upgrade to version 5.7.7 or later, which patches the SQL injection by properly parameterizing the 'IS NULL' and 'IS NOT NULL' comparisons in `OsModel::build_conditions_query()`.","detection":"Defenders should monitor WordPress debug logs and database query logs for SQL queries containing unbound literal strings 'IS NULL' or 'IS NOT NULL' in WHERE clauses on tables storing account_nonse or order_intent_key values; additionally, repeated failed password reset attempts followed by successful resets for low-ID users may indicate exploitation.","tags":["sql-injection","auth-bypass","account-takeover","wordpress","plugin","ajax"],"model":"garnet-coder","analyzedAt":"2026-11-08T09:47:08.441Z"}}