Vulnerability · Published Sep 30, 2025 · Assigned by Wordfence
CVE-2025-7052LatePoint <= 5.1.94 - Cross-Site Request Forgery to Account Takeover via change_password() Function
High 8.8
In plain English
A high-severity cross-site request forgery in LatePoint – Calendar Booking Plugin for Appointments and Events from latepoint. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 12% of all known vulnerabilities).
Official description
The LatePoint plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.1.94. This is due to missing nonce validation on the change_password() function of its customer_cabinet__change_password AJAX route. The plugin hooks this endpoint via wp_ajax and wp_ajax_nopriv but does not verify a nonce or user capability before resetting the user’s password. This makes it possible for unauthenticated attackers who trick a logged-in customer (or, with “WP users as customers” enabled, an administrator) into visiting a malicious link to take over their account.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| latepoint | LatePoint – Calendar Booking Plugin for Appointments and Events | 0 – through 5.1.94 |
Weakness: CWE-352 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- https://www.wordfence.com/threat-intel/vulnerabilities/id/df8a8ce0-7258-40ae-bf73-f8c6185fdd16?source=cve
- https://plugins.trac.wordpress.org/browser/latepoint/tags/5.1.93/lib/controllers/customer_cabinet_controller.php#L403
- https://wordpress.org/plugins/latepoint/#developers
- https://plugins.trac.wordpress.org/browser/latepoint/tags/5.1.93/latepoint.php
- https://plugins.trac.wordpress.org/changeset/3366851/latepoint/tags/5.2.0/lib/controllers/customer_cabinet_controller.php