LatePoint Booking Plugin Auth Bypass and Info Disclosure

LatePoint WordPress plugin through 5.7.4 allows unauthenticated remote attackers who know a target customer's registered email address or phone number to bypass OTP authentication by racing the attempts counter and brute-forcing the 6-digit code, potentially taking over that customer's account, bookings, and personal data. Exploitation requires the site to use LatePoint's OTP/passwordless login flow and the attacker to win a concurrency race while guessing the code; no public exploit identified at time of analysis.

Unauthenticated customer-record disclosure in the LatePoint appointment booking plugin for WordPress, affecting all versions up to and including 5.7.4, allows remote attackers to harvest the first name, last name, email address, phone number and notes of every customer in the database by enumerating UUID prefixes through the steps__load_step AJAX endpoint using the params[customer[uuid]] parameter. Exploitation is strictly gated on a non-default configuration: the plugin's 'Field used for authentication' setting must be set to 'Disable ability to login' (guest checkout mode), so sites using default login-based authentication are not exposed. No public exploit code was identified at time of analysis; the AC:H rating reflects the request-heavy prefix enumeration required, which rate limiting or a WAF may slow or detect but does not prevent on an unprotected site.