PT-2026-39316 · WordPress · Latepoint

Michael Iden · Published 2026-05-09 · Updated 2026-05-11 · CVE-2026-7652

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions LatePoint versions prior to 5.5.1

Description A weak password recovery mechanism in the unauthenticated guest booking flow allows for account takeover. The save connected wordpress user() function uses wp update user() to propagate a customer's email address to a linked WordPress user account without ownership verification. This, combined with the ability to overwrite a customer's email through phone-based merge without authentication, allows unauthenticated attackers to change the email address of a non-super-admin WordPress user account not yet linked to a LatePoint customer. Attackers can then trigger the standard WordPress password-reset flow to an address they control. This occurs when the plugin has WordPress user integration enabled, phone-based contact merging active, and customer authentication disabled.

Recommendations Update to a version later than 5.5.0. As a temporary mitigation, disable WordPress user integration, phone-based contact merging, or enable customer authentication.

Fix

Weakness Enumeration

CWE-640

Related Identifiers

CVE-2026-7652

Affected Products

Latepoint

References · 21

• https://nvd.nist.gov/vuln/detail/CVE-2026-7652 · Security Note
• https://twitter.com/CVEnew/status/2053131400946307555 · Twitter Post
• https://plugins.trac.wordpress.org/browser/latepoint/tags/5.4.2/lib/helpers/steps_helper.php#L1972 · Note
• https://plugins.trac.wordpress.org/changeset?old_path=%2Flatepoint/tags/5.5.0&new_path=%2Flatepoint/tags/5.5.1 · Note
• https://plugins.trac.wordpress.org/browser/latepoint/tags/5.5.0/lib/helpers/customer_helper.php#L238 · Note
• https://plugins.trac.wordpress.org/browser/latepoint/trunk/latepoint.php#L1165 · Note
• https://plugins.trac.wordpress.org/browser/latepoint/tags/5.4.2/lib/helpers/steps_helper.php#L1940 · Note
• https://t.me/cveNotify/162842 · Telegram Post
• https://plugins.trac.wordpress.org/browser/latepoint/tags/5.4.2/latepoint.php#L1165 · Note
• https://plugins.trac.wordpress.org/browser/latepoint/tags/5.4.2/lib/helpers/customer_helper.php#L238 · Note
• https://plugins.trac.wordpress.org/browser/latepoint/tags/5.5.0/lib/helpers/steps_helper.php#L1940 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/bdaa32cd-a148-4554-9fd5-f5b0a5b2d1c3?source=cve · Note
• https://t.me/CVEtracker/53195 · Telegram Post
• https://plugins.trac.wordpress.org/browser/latepoint/trunk/lib/helpers/customer_helper.php#L238 · Note
• https://plugins.trac.wordpress.org/browser/latepoint/trunk/lib/helpers/steps_helper.php#L1972 · Note