LatePoint: flaw lets attackers take over customer accounts, update now
The LatePoint booking plugin up to version 5.7.6 has a serious flaw. Anyone, without logging in, can change a customer's password and get to their bookings, orders and personal data. It is fixed in version 5.7.7, the latest is 5.7.8.
Who is affected
Every site running LatePoint (Appointment Booking Plugin – LatePoint) version 5.7.6 or older. The LatePoint customer account is at risk: name, email, phone, bookings and orders. If customers are linked to WordPress users, the attacker also takes over their WordPress account (customer or subscriber role). Administrator accounts are not directly at risk.
What to do
- Update. Make a backup first. In the admin, open Plugins and click Update next to LatePoint.
- Check the version. Plugins must show LatePoint 5.7.7 or higher.
- Check paid add-ons. If you use LatePoint add-ons (Pro Features and others), update them too so the versions match.
If you can't update
Back up the site and deactivate the plugin for now. Online booking will be unavailable until you update, but customer data stays safe. Meanwhile, take bookings by email or another tool.
How to tell if it happened
A customer tells you they can't log in, or they got a password reset email they never asked for. In your hosting access log, look for repeated requests to admin-ajax.php with the actions customer_cabinet__change_password and steps__start_from_order_intent from unknown addresses. If customer data may have leaked, treat it as a personal data breach and reset the affected customers' passwords. New administrators, unknown files or redirects would point to a more serious compromise and need a check.
Not sure? Check your site with the Website Checker, or ask me for a security audit. The initial check is free.
Source: CVE-2026-118066, Wordfence.