LatePoint’s password-reset flow can let an unauthenticated attacker replace a customer’s password and access their account, according to Wordfence. Site operators should install a patched release.
The issue, CVE-2026-118066, affects versions through 5.7.6. Wordfence rates it Critical, with a CVSS 3.1 score of 9.1.
Customer access is the documented impact
Wordfence says the database-query layer can interpret a submitted reset-token value as an operator instead of data. Text sanitisation and the scalar check added in 5.7.5 do not prevent this.
The documented path selects the first matching customer, exposing that customer’s bookings, orders and personal information. With wp_users_as_customers enabled, the linked WordPress subscriber or customer account is also affected. The advisory does not demonstrate Administrator takeover.
Wordfence identifies 5.7.7 as patched and dates disclosure to November 6. The CVE Program record was published November 7. Neither reviewed record reports active exploitation; that cannot exclude unreported attacks.
The fix was available before disclosure
The official plugin changelog dates 5.7.7 to November 2 and credits Wordfence for security hardening. It also lists 5.7.8, released November 3 with another security fix. The public vulnerability report is therefore newer than the minimum fixed release.
DaySec recommends checking the installed version after updating, then testing a normal customer login, password reset and booking. Use a test customer account for those checks, rather than risking a live customer’s password or reservations.
For sites that ran an affected release, review unexpected reset activity and customer-account changes. Compare suspicious logins with booking or order changes where records are available. Patching prevents further use of the vulnerable path; it does not determine whether an account was accessed earlier or undo changes already made.
