CVE-2025-7038

Name of the Vulnerable Software and Affected Versions LatePoint plugin for WordPress versions through 5.1.94

Description The LatePoint plugin for WordPress has a flaw that allows bypassing authentication. This is due to inadequate identity verification within the steps load step route of the latepoint route call API endpoint. The endpoint processes client-supplied customer email and related fields before invoking the internal login handler without verifying login status, capability checks, or a valid AJAX nonce. This allows unauthenticated attackers to log into any customer’s account. The vulnerable API endpoint is /latepoint route call. The vulnerable parameter is customer email.

Recommendations Update the LatePoint plugin to a version later than 5.1.94.