WordPress Booking Plugin Authentication Bypass via User Matching

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 5.7.2 via the OsCustomerHelper::create_wp_user_for_customer() helper reached from the public process_step_customer() booking step. When the 'Use WordPress users as customers' option is enabled, the helper falls back from email_exists() to username_exists( $customer->email ), which matches any WordPress user whose user_login equals the victim customer's email even when that user's user_email is completely different, and links that WordPress user's ID into the victim's LatePoint customer row (only privileged roles are excluded; Subscriber is allowed). This makes it possible for authenticated attackers, with Subscriber-level access and above, to take over another customer's LatePoint account — accessing their bookings, service, agent, and calendar data, and having the victim customer's email overwritten with the atta

Casky was already ahead

This CVE exploits attack patterns that Casky's 283matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The Appointment Booking Plugin – LatePoint for WordPress contains a critical authentication bypass vulnerability in versions up to 5.7.2 that allows attackers to impersonate existing WordPress users during the booking process. When the 'Use WordPress users as customers' feature is enabled, the plugin's customer creation helper function falls back to matching usernames against email addresses, creating a logic flaw where an attacker can register a booking using an email address that matches any existing WordPress user's login name. This affects any WordPress site running the vulnerable plugin with this feature active, potentially exposing customer data, enabling unauthorized account access, and allowing attackers to manipulate booking records tied to legitimate administrator or user accounts.

Casky's skill mapping identifies this vulnerability across 283 relevant security techniques spanning MITRE ATT&CK's Initial Access (TA0004) and Credential Access (TA0006) phases. Practitioners using Casky would observe detection patterns for T1190 (Exploit Public-Facing Application) when the public process_step_customer() endpoint is probed, and T1110 (Brute Force) patterns when attackers systematically test email-to-username matching logic. Claude's extended reasoning would correlate the flawed email_exists() to username_exists() fallback as a classic authentication bypass signature, flag the lack of proper user verification during account creation, and surface behavioral anomalies such as booking records created with administrative user associations or rapid account creation attempts using common username patterns—enabling practitioners to detect exploitation before data exfiltration occurs.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

283 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-100163.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Investigate the attack patterns behind CVE-2026-100163

Casky has 283 skills that investigate the attack patterns behind CVE-2026-100163. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn