Security notice
Take bookings on WordPress with LatePoint? Someone without a login can take over your customers' accounts. Update to 5.7.7 or later today.
LatePoint versions 5.7.6 and earlier have CVE-2026-118066, an unauthenticated authentication bypass. Someone without a login can reset a LatePoint customer's password and take over that customer's account, including their bookings, orders and personal details. Patchstack marks it as known to be exploited. Update to 5.7.7 or later today; WordPress.org now lists 5.7.8. If you cannot update, deactivate the plugin until you can. (Patchstack, Wordfence, NVD)
What happened
- The flaw. CVE-2026-118066 affects the LatePoint appointment booking plugin for WordPress through 5.7.6. A weakness in the public customer password reset flow lets an attacker without a login overwrite a LatePoint customer's password with one they choose. The same weakness can also reveal a customer's name and email address. (Patchstack, Wordfence, NVD)
- What an attacker gets. Full access to that customer's account: their bookings, orders and personal details. If your site links LatePoint customers to WordPress user accounts, the linked customer or subscriber WordPress account can be taken over too. The published reports do not describe a direct takeover of administrator accounts. (Wordfence, NVD)
- The fix. Patchstack lists 5.7.7 as the patched version. WordPress.org currently ships 5.7.8. (Patchstack, WordPress.org)
- Severity. Patchstack rates it CVSS 9.8, high priority, and marks it as known to be exploited. Wordfence, which assigned the CVE, rates it 9.1 (critical). (Patchstack, NVD)
Who should worry
Any WordPress site running LatePoint 5.7.6 or earlier, especially sites where customers have accounts to manage bookings. Sites that link LatePoint customers to WordPress users have more at stake, because those WordPress accounts can be taken over as well. (NVD)
WordPress.org lists 100,000+ active installations. That is a plugin installation count, not a count of affected or compromised sites. (WordPress.org)
What to do now
- Update to 5.7.7 or later today, preferably 5.7.8. Back up the site and database first, then update the plugin through WordPress. (Patchstack, WordPress.org)
- If the update has to wait, deactivate the plugin until you can install the fixed version. This pauses online booking, so tell customers how to book in the meantime.
- Review customer accounts. Look for password resets your customers did not request, customers reporting they cannot log in, and unexpected changes to bookings, orders or customer details. Updating closes the flaw; it does not undo access an attacker may already have gained.
- Contact affected customers. If you find signs of takeover, reset those passwords, tell the customers, and ask your developer to investigate.
What to send your developer, agency or host
Please check whether our WordPress site runs the LatePoint appointment booking plugin. CVE-2026-118066 affects versions 5.7.6 and earlier; it is an unauthenticated authentication bypass in the customer password reset flow that allows customer account takeover, fixed in 5.7.7 (WordPress.org now lists 5.7.8). Please update today, or deactivate until the update can be installed. Please also check whether LatePoint customers are linked to WordPress user accounts, review recent customer password resets and account activity, and confirm the version you left us on. Sources: Patchstack, Wordfence, NVD.
Common questions
Does this mean my site was hacked?
No. A vulnerable version is a reason to update and review the site, not proof of a break-in. Patchstack marks this flaw as known to be exploited, so do not wait.
Can EverThread tell me if I am affected?
No. EverThread does not test for this. We cannot see which WordPress plugins your site runs or which versions they are on. A scan without a warning about this plugin does not mean your site is safe.
Where can I follow updates?
Follow Patchstack, Wordfence, the NVD entry and the plugin page on WordPress.org. All current notices are on our notices page.
Security alerts by email
Hear about the next one first.
When a flaw puts websites at risk, we send one email: what happened, who it affects and what to do. It's free, whether or not you use EverThread.
Sources
- Patchstack: CVE-2026-118066, affected through 5.7.6, patched in 5.7.7, CVSS 9.8, published November 7, 2026.
- Wordfence: Wordfence threat intelligence entry for CVE-2026-118066.
- NVD: CVE-2026-118066, published November 7, 2026, Wordfence CVSS 9.1.
- WordPress.org: plugin version information (5.7.8) and 100,000+ active installations.