LatePoint Appointment Booking Plugin allows authenticated attackers with Subscriber role or higher to bypass authentication and hijack another customer’s account. The flaw originates from create_wp_user_for_customer() which, when the "Use WordPress users as customers" option is active, falls back from checking the customer’s email to checking the WordPress username that matches that email. This bypass enables a user whose WordPress login equals a target customer’s email to be linked to that customer’s record, thereby granting the attacker full access to bookings, services, agents, and calendar data. The weakness is an authentication bypass (CWE‑287).

Any WordPress site running the LatePoint Appointment Booking Plugin version 5.7.2 or earlier where the "Use WordPress users as customers" feature is turned on. No other vendors or products are listed as affected.

The CVSS score of 7.4 indicates high severity, but the EPSS score is less than 1%, suggesting a low probability of exploitation at present. The vulnerability is not listed in CISA’s KEV catalog. Attackers can exploit the flaw by submitting an unauthenticated public booking step registration request while possessing a WordPress account whose user_login matches the victim’s email. Because only privileged roles are excluded and Subscriber accounts can trigger the flaw, any registered user who satisfies this condition could hijack another customer’s account.