CVE-2026-110653 affects the LatePoint appointment-booking plugin for WordPress, where versions up to and including 5.7.4 let attackers bypass OTP verification through a race condition. The flaw stems from the attempts counter being updated from a stale in-memory value with no locking in place, so concurrent requests can slip past the login-attempt limit before it is enforced. That TOCTOU gap effectively lets an attacker brute-force the one-time code and log in without valid credentials.
// source: nvd.nist.gov ↗