{
    "dataType": "CVE_RECORD",
    "dataVersion": "5.2",
    "cveMetadata": {
        "cveId": "CVE-2026-118066",
        "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "state": "PUBLISHED",
        "assignerShortName": "Wordfence",
        "dateReserved": "2026-10-27T15:39:47.322Z",
        "datePublished": "2026-11-07T11:26:26.913Z",
        "dateUpdated": "2026-11-07T11:26:26.913Z"
    },
    "containers": {
        "cna": {
            "providerMetadata": {
                "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
                "shortName": "Wordfence",
                "dateUpdated": "2026-11-07T11:26:26.913Z"
            },
            "affected": [
                {
                    "vendor": "latepoint",
                    "product": "Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress",
                    "versions": [
                        {
                            "version": "0",
                            "status": "affected",
                            "lessThanOrEqual": "5.7.6",
                            "versionType": "semver"
                        }
                    ],
                    "defaultStatus": "unaffected"
                }
            ],
            "descriptions": [
                {
                    "lang": "en",
                    "value": "The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Authentication Bypass via Account Takeover in all versions up to, and including, 5.7.6. This is due to the `OsModel::build_conditions_query()` function in `lib/models/model.php` comparing WHERE-clause values against the literal strings `'IS NULL'` and `'IS NOT NULL'` and concatenating a match directly into SQL without binding it as a parameter, a flaw that neither `sanitize_text_field()` nor the 5.7.5 `is_scalar()` hardening guard closes, since both pass the scalar sentinel through unchanged. This makes it possible for unauthenticated attackers to send `params[password_reset_token]=IS NOT NULL` to the public `customer_cabinet__change_password` AJAX route to match every non-null `account_nonse` value, resolving to the lowest-id customer and overwriting that customer's password to an attacker-chosen value — granting full access to their bookings, orders, and PII, and, when the `wp_users_as_customers` option is enabled, takeover of the linked WordPress subscriber or customer-role account. The attacker can first identify the target customer's email by sending `params[order_intent_key]=IS NOT NULL` to the public `steps__start_from_order_intent` route, which returns the name and email from the first matching order intent, and can then self-arm the required 15-minute password-reset freshness window by triggering a reset for that customer directly."
                }
            ],
            "title": "Appointment Booking Plugin <= 5.7.6 - Unauthenticated Authentication Bypass via Account Takeover via 'IS NOT NULL' Sentinel in 'password_reset_token' Parameter",
            "references": [
                {
                    "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2f7f5dc8-8cf7-493d-b012-89ff36a4dc02?source=cve"
                },
                {
                    "url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.5/lib/models/model.php#L414"
                },
                {
                    "url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.5/lib/controllers/customer_cabinet_controller.php#L494"
                },
                {
                    "url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.5/lib/controllers/steps_controller.php#L178"
                },
                {
                    "url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.5/lib/helpers/customer_helper.php#L235"
                },
                {
                    "url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.5/lib/helpers/order_intent_helper.php#L184"
                },
                {
                    "url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.5/lib/helpers/params_helper.php#L14"
                },
                {
                    "url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.5/latepoint.php#L1073"
                },
                {
                    "url": "https://plugins.trac.wordpress.org/changeset?reponame=&old=3779410%40latepoint&new=3779410%40latepoint"
                }
            ],
            "problemTypes": [
                {
                    "descriptions": [
                        {
                            "lang": "en",
                            "description": "CWE-287 Improper Authentication",
                            "cweId": "CWE-287",
                            "type": "CWE"
                        }
                    ]
                }
            ],
            "metrics": [
                {
                    "cvssV3_1": {
                        "version": "3.1",
                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
                        "baseScore": 9.1,
                        "baseSeverity": "CRITICAL"
                    }
                }
            ],
            "credits": [
                {
                    "lang": "en",
                    "type": "finder",
                    "value": "Jakub Herman"
                }
            ],
            "timeline": [
                {
                    "time": "2026-10-27T16:02:17.000Z",
                    "lang": "en",
                    "value": "Vendor Notified"
                },
                {
                    "time": "2026-11-06T22:55:13.000Z",
                    "lang": "en",
                    "value": "Disclosed"
                }
            ]
        }
    }
}