CVE Watch: 18 October 2026, a 9.1 authentication bypass in a booking plugin and an unauthenticated write into post metadata

A batch of new WordPress plugin records that NVD published between 16 and 18 October makes up this edition, and none of them appear in CISA’s KEV catalog ¹. They cover bookings, events, forms and payments. I would open the 9.1 authentication bypass in LatePoint first, because a stranger reaches it without an account ².

A 9.1 authentication bypass through a race condition

CVE-2026-110653 is an authentication bypass in the LatePoint appointment booking plugin, with a CVSS 3.1 score of 9.1, and it covers every version through 5.7.4 ². The flaw sits in the one-time passcode check: the handler reads the attempt counter, increments it in memory and writes it back with no conditional guard on the update and no row lock ². Send the verification requests together and the ten-attempt lockout never closes ². An attacker needs no account and no privilege, but does need the target customer’s registered email address or phone number to start ². Nobody reports exploitation ¹². My first check is inventory: whether a site runs LatePoint, and which version.

An unauthenticated write into the metadata of any post

CVE-2026-87844 covers PickPlugins Product Designer for WooCommerce through 1.0.40 ³. The nonce check is inverted, so the code accepts a missing or invalid nonce and rejects a valid one, and the handler performs no capability check and no validation of the target post ³. A stranger can insert design template data into the metadata of any post on the site ³. NVD has no score for it yet, and no exploitation report ¹³. Plugin metadata writes are a routine staging step for a stored payload, so the installed version matters more than the missing score.

Every booking on the site, readable by any account

CVE-2026-110069 is in Modern Events Calendar Lite before 7.37.0 ⁴. The handler that returns booking and attendee data performs no capability, nonce or ownership check, so any authenticated user, Subscribers included, can read the names, email addresses, transaction IDs and payment amounts attached to every booking on the site ⁴. Any account a site gives away at registration can do that. The entry carries no score at NVD and no exploitation report ¹⁴. I would check whether self-registration is open, because that decides how much of this is reachable.

A PHP object injection that can reach code execution

CVE-2026-81344 is in ACF Frontend Admin by DynamiApps through 3.29.13 ⁵. The plugin deserialises stored post content that it renders on public pages, and it does not restrict which PHP classes may be instantiated ⁵. A user who can create that content, an administrator in the description, plants a serialised object. Where another installed plugin or WordPress core provides a suitable chain, an attacker can turn that object into remote code execution ⁵. The attacker needs a privileged account first, so the urgency is lower, and nobody reports exploitation ¹⁵. The payload sits in stored content, so my first check is who can write there.

An unauthenticated file read through a form email

CVE-2026-104246 is in the Contact Form 7 Signature Addon through 4.2.2 ⁶. The addon builds an email attachment path from a signature field value without sanitising that value, so an unauthenticated user can use path traversal to attach arbitrary files to the form’s outgoing email ⁶. The reach stops at the site’s content directory, and the read only happens when the form also emails a copy to the submitter ⁶. The record has no score and no exploitation report ¹⁶. That is a file read on any site whose contact form emails the submitter a copy.

A server-side fetch and a stored image in one flaw

CVE-2026-110033 affects Salon Booking System before 10.31.11 ⁷. The plugin fetches a user-supplied image URL server-side and writes the response to a file path anyone can reach, under a filename the requester chooses ⁷. An account holding the plugin’s staff role can make the server read resources that are not reachable from outside and publish them, and the same path stores an SVG that runs in the site’s origin for anyone who opens it ⁷. I would start with the staff role and who holds it. NVD has not scored it and nobody reports exploitation ¹⁷.

A Subscriber who can edit any post on the site

CVE-2026-110070 sits in the same events calendar, Modern Events Calendar Lite before 7.36.4, and it skips the check that the user may edit the target post before writing the update ⁸. An account at the Subscriber level can change the title, content and excerpt of posts, pages and custom post types that other people created ⁸. That is site defacement from an account anyone can create, alongside the data exposure in the same plugin ⁴⁸. This one also carries no score and no exploitation report ¹⁸. The fixes land at 7.36.4 and 7.37.0, so an update has to reach the higher one to close both.

A credential shipped inside the plugin

CVE-2026-109930 is in the MAIO plugin before 7.3.22, and WPScan, the CNA on the record, scores it 5.3 ⁹. The plugin guards its analytics data with a credential value that ships verbatim in its own public source, so an unauthenticated request that presents that value returns the stored crawl log ⁹. The log holds each visitor’s IP address, user agent and referrer ⁹. Nobody reports exploitation and CISA has not listed it ¹⁹. I would log this as privacy exposure, and the first check is whether the plugin is installed at all.

Each of these comes down to a plugin version, a role, or an install nobody remembers, and I would want that inventory written down.