The LatePoint Appointment Booking Plugin is affected by a non‑atomic read‑modify‑write on the OTP attempts counter in the verifyOTP function, creating a race condition that allows attackers to circumvent the 10‑attempt lockout. Because the counter is updated from a stale in‑memory value without a WHERE attempts < 10 guard or a SELECT … FOR UPDATE row lock, concurrent requests can increment the counter out of order and ultimately cause the 10‑attempt caps to be bypassed. This flaw is classified as an Authentication Bypass weakness (CWE‑287). An attacker who knows a target customer’s registered email or phone can launch parallel requests to the auth__verify_otp endpoint, brute‑force the 6‑digit OTP, and gain unverified access to the user’s account, including their bookings and personal data.

The Vulnerability applies to the LatePoint Appointment Booking Plugin for WordPress, affecting all published releases up through and including version 5.7.4. No other versions are listed as affected. WordPress sites that have installed the plugin in those versions are at risk.

The CVSS score of 9.1 indicates a high severity with wide impact on confidentiality, integrity, and availability. The EPSS score is not available, but the lack of a KEV listing does not reduce the exploit potential. Based on the description, the likely attack vector is unauthenticated, requiring only knowledge of a target’s email or phone. An attacker can exploit the race condition by flooding the auth__verify_otp endpoint with concurrent requests, thereby bypassing the lockout cap and successfully brute‑forcing the OTP to authenticate as the target user.