If customers book appointments on your website, this one's worth five minutes. Two popular WordPress booking plugins, LatePoint and Amelia, just had serious security holes made public, and a leading WordPress security database now flags both as being used in real attacks. Both are already fixed. Here's what happened, in plain English, and what to check.
What happened
LatePoint is a free appointment booking plugin that WordPress.org lists on more than 100,000 websites. It's built for exactly the kind of businesses we work with: coaches, salons, consultants, clinics, home service companies and more. Every version up to and including 5.7.6 has a flaw, tracked as CVE-2026-118066, that lets someone with no account overwrite a customer's password and take over that customer's account, including their bookings, orders and personal details. If your site is set up so LatePoint customers are also WordPress users, the linked WordPress account can be taken over too.
Patchstack, a WordPress security company that tracks these issues, published it on November 7, rated it 9.8 out of 10 and marked it "known to be exploited".
Amelia is another well-known booking and events plugin. This flaw, CVE-2026-116751, is in the paid version, Amelia Pro, versions 4.0 through 9.9.1. It lets someone with no account slip their own commands into the site's database and pull out sensitive information. Patchstack published it on November 6, rated it 9.3 out of 10 and also marked it "known to be exploited".
Why this matters for your business
A booking plugin holds some of the most personal data on your website: names, emails, phone numbers, appointment history and sometimes payment records. With both of these flaws, the attacker doesn't need a login or any help from a customer. Patchstack's warning is blunt: flaws like these are used in mass-exploit campaigns that hit thousands of websites at a time, regardless of traffic size or popularity. Being a small local business doesn't keep you off the list.
What's been fixed
LatePoint fixed it in version 5.7.7 on November 2, and version 5.7.8 on November 3 added another security fix. Amelia released Amelia Pro 9.9.2 on November 4 as an important security update and recommends installing it immediately.
One catch with Amelia: the free version on WordPress.org uses different version numbers than Pro, so don't confuse the free plugin's version with the Pro version you're actually running. And because Pro is a paid plugin, its updates come through the vendor's licensed update channel. If your license lapsed, your site may not be getting updates at all.
What I'd do this week
- Check whether you use either plugin. Log in to WordPress, go to Plugins, and look for LatePoint or Amelia. If you don't see either, you're not affected by this one.
- Update LatePoint to 5.7.8. At minimum you need 5.7.7, but 5.7.8 is current and has an extra security fix.
- Update Amelia Pro to 9.9.2 or later. Check the version of the Pro plugin itself, and make sure your license is active so the update comes through.
- Clear your cache. Purge any page, plugin or CDN cache after updating, as security researchers recommend.
- Look for anything odd. For LatePoint, check for unexpected customer password changes, bookings, orders or new user accounts. If a customer says they can't log in, take it seriously.
- If you can't update today, deactivate the plugin until you can. Taking phone bookings for a day beats leaking your customer list.
- Turn on automatic updates for plugins you trust. The LatePoint fix was out days before the warnings went public.
If you're lost, we can help
If you're not sure which booking tool your website uses, or whether your license is current, that's normal. HDM has been building and caring for websites out of Springboro, Ohio for 20 years. Send us a request and we'll check your site and tell you plainly what we find, or call us at (513) 668-7344.
