PT-2025-39956 · WordPress · Latepoint

Wesley · Published 2025-09-30 · Updated 2025-10-05 · CVE-2025-7038

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions LatePoint plugin for WordPress versions through 5.1.94

Description The LatePoint plugin for WordPress has a flaw that allows bypassing authentication. This is due to inadequate identity verification within the steps load step route of the latepoint route call API endpoint. The endpoint processes client-supplied customer email and related fields before invoking the internal login handler without verifying login status, capability checks, or a valid AJAX nonce. This allows unauthenticated attackers to log into any customer’s account. The vulnerable API endpoint is /latepoint route call. The vulnerable parameter is customer email.

Recommendations Update the LatePoint plugin to a version later than 5.1.94.

Fix

Authentication Bypass Using an Alternate Path or Channel

Weakness Enumeration

CWE-288

Related Identifiers

CVE-2025-7038

Affected Products

Latepoint

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2025-7038 · Security Note
• https://plugins.trac.wordpress.org/browser/latepoint/tags/5.1.93/latepoint.php · Note
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3366851%40latepoint&new=3366851%40latepoint&sfp_email=&sfph_mail= · Note
• https://twitter.com/cracbot/status/1974791719901106500 · Twitter Post
• https://twitter.com/ZeroPathLabs/status/1973000862243922411 · Twitter Post
• https://wordpress.org/plugins/latepoint/#developers · Note
• https://twitter.com/VolerionSec/status/1972996025934590337 · Twitter Post
• https://plugins.trac.wordpress.org/browser/latepoint/tags/5.1.93/lib/controllers/steps_controller.php · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/d7389e17-a357-481a-8716-3a93cb6afa7c?source=cve · Note
• https://twitter.com/CVEnew/status/1972887114867253333 · Twitter Post
• https://t.me/CVEtracker/33698 · Telegram Post