PT-2025-39957 · WordPress · Latepoint

Wesley · Published 2025-09-30 · Updated 2025-10-05 · CVE-2025-7052

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions LatePoint plugin for WordPress versions through 5.1.94

Description The software is susceptible to Cross-Site Request Forgery due to the absence of nonce validation. This occurs on the change password() function within the customer cabinet change password AJAX route. The plugin utilizes wp ajax and wp ajax nopriv hooks for this endpoint without verifying a nonce or user capability before allowing password resets. This allows unauthenticated attackers to potentially take over accounts by tricking logged-in customers, or administrators with “WP users as customers” enabled, into visiting a malicious link.

Recommendations Update the LatePoint plugin to a version newer than 5.1.94.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2025-7052

Affected Products

Latepoint

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2025-7052 · Security Note
• https://plugins.trac.wordpress.org/browser/latepoint/tags/5.1.93/latepoint.php · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/df8a8ce0-7258-40ae-bf73-f8c6185fdd16?source=cve · Note
• https://twitter.com/cracbot/status/1974791721876689164 · Twitter Post
• https://plugins.trac.wordpress.org/changeset/3366851/latepoint/tags/5.2.0/lib/controllers/customer_cabinet_controller.php · Note
• https://wordpress.org/plugins/latepoint/#developers · Note
• https://twitter.com/CVEnew/status/1972887113923457220 · Twitter Post
• https://twitter.com/ZeroPathLabs/status/1973002164281766326 · Twitter Post
• https://plugins.trac.wordpress.org/browser/latepoint/tags/5.1.93/lib/controllers/customer_cabinet_controller.php#L403 · Note
• https://t.me/CVEtracker/33692 · Telegram Post