The vulnerability in the LatePoint Appointment Booking Plugin allows unauthenticated attackers to bypass authentication by manipulating the 'password_reset_token' parameter to the literal 'IS NOT NULL'. This causes the plugin to construct a SQL condition that matches every non‑null account, selecting the lowest‑ID customer and overwriting that user's password with a value chosen by the attacker. The attacker then gains full access to the compromised customer's bookings, orders, and personally identifiable information. The weakness is an authentication bypass, classified as CWE‑287.

Affected systems are installations of the LatePoint plugin for WordPress version 5.7.6 and earlier. These versions are distributed through the WordPress plugin repository and may be present on any site that has not yet been upgraded. No other vendors or products are listed.

The CVSS score of 9.1 indicates high severity. Because the exploit requires only unauthenticated HTTP requests to public AJAX routes and no special privileges, the risk of exploitation is high, especially if the site is publicly accessible. EPSS is not available, but the lack of a KEV listing does not diminish the urgency; the vulnerability can be actively exploited by sending crafted requests to the exposed endpoints. An attacker can first discover a target customer by querying the order intent endpoint, then reset the password within the 15‑minute freshness window and assume control of the account.