{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-100163",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-14T17:40:58.748355Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-14T17:41:31.054Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Appointment Booking Plugin \u2013 LatePoint | Calendar \u0026 Scheduling for WordPress",
          "vendor": "latepoint",
          "versions": [
            {
              "lessThanOrEqual": "5.7.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "OKISO"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Appointment Booking Plugin \u2013 LatePoint | Calendar \u0026 Scheduling for WordPress plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 5.7.2 via the OsCustomerHelper::create_wp_user_for_customer() helper reached from the public process_step_customer() booking step. When the \u0027Use WordPress users as customers\u0027 option is enabled, the helper falls back from email_exists() to username_exists( $customer-\u003eemail ), which matches any WordPress user whose user_login equals the victim customer\u0027s email even when that user\u0027s user_email is completely different, and links that WordPress user\u0027s ID into the victim\u0027s LatePoint customer row (only privileged roles are excluded; Subscriber is allowed). This makes it possible for authenticated attackers, with Subscriber-level access and above, to take over another customer\u0027s LatePoint account \u2014 accessing their bookings, service, agent, and calendar data, and having the victim customer\u0027s email overwritten with the attacker\u0027s on next login \u2014 by holding a Subscriber account whose user_login equals the victim\u0027s email and submitting an unauthenticated public booking step registration request."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-287",
              "description": "CWE-287 Improper Authentication",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-14T07:43:31.547Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2a942d71-7172-4e02-9faa-3a2c1c9e7fbd?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.2/lib/helpers/customer_helper.php#L259"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.2/lib/helpers/customer_helper.php#L274"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.2/lib/helpers/steps_helper.php#L2156"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.2/lib/helpers/steps_helper.php#L2146"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.2/latepoint.php#L1072"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.3/lib/helpers/customer_helper.php"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-09-25T12:49:14.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-10-13T19:19:40.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Appointment Booking Plugin \u003c= 5.7.2 - Unauthenticated Authentication Bypass to Customer Account Takeover via Insufficient Verification in create_wp_user_for_customer() username_exists Fallback"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-100163",
    "datePublished": "2026-10-14T07:43:31.547Z",
    "dateReserved": "2026-09-25T12:34:07.288Z",
    "dateUpdated": "2026-10-14T17:41:31.054Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}