LatePoint CVE-2026-100163

Exploitation requires three concrete prerequisites, all drawn from the description: (1) the site must have the 'Use WordPress users as customers' option ENABLED - without it the vulnerable email_exists()/username_exists() linking path in OsCustomerHelper::create_wp_user_for_customer() is not reached; (2) the attacker must possess a WordPress account at Subscriber level or above (privileged roles are excluded, but Subscriber - commonly available via open registration - is permitted); and (3) that account's user_login must be set equal to the victim customer's email address, so the attacker must know the target email in advance. The triggering request is the public, unauthenticated process_step_customer() booking step. Limiting factors that reduce real-world risk: the WordPress-user option is a non-default/opt-in configuration, open user registration must be enabled (or the attacker must otherwise obtain a Subscriber account), and the attack is per-victim (requires crafting a username per target), making it targeted rather than scalable.

This is a genuine but conditional integrity/confidentiality issue rather than a drop-everything emergency. The input CVSS vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N, 7.4) marks the flaw as unauthenticated (PR:N), but this directly CONFLICTS with the description, which states the attacker must hold a Subscriber-level (or higher) WordPress account whose user_login equals the victim's email - i.e. authenticated pre-conditions exist even though the triggering booking request itself is submitted unauthenticated. Treat PR:N as misleading: the realistic access requirement is PR:L (a provisioned Subscriber account), which is why I independently assess this closer to 6.8 than 7.4. The high attack complexity (AC:H) is justified - exploitation depends on a non-default option being enabled and on the attacker knowing and pre-registering the victim's email as a username. No EPSS score, SSVC decision, KEV listing, or public POC is present in the input, so there is no signal of active or widespread exploitation. Overall: a credible account-takeover vector for sites that (a) run LatePoint ≤5.7.2, (b) enable 'Use WordPress users as customers', and (c) permit open Subscriber registration - but not a mass-exploitation priority on current evidence. Prioritize patching on affected configurations; de-prioritize where registration is closed or the WordPress-user option is off.

An attacker self-registers (or obtains) a WordPress Subscriber account and sets its username (user_login) to the email address of a target LatePoint customer. On a site with 'Use WordPress users as customers' enabled, the attacker submits the public booking customer step; the flawed email_exists()→username_exists() fallback matches the attacker's Subscriber account to the victim's email and links that account to the victim's LatePoint customer row, granting access to the victim's bookings, service, agent, and calendar data. No public exploit identified at time of analysis, though the WordPress booking endpoint is network-reachable (AV:N) and the attack requires no victim interaction.